{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:338e849e-26b1-4256-b96c-4337323b56e7", "version": 1, "metadata": { "timestamp": "2026-10-09T15:10:09+00:00", "tools": { "components": [ { "type": "application", "manufacturer": { "name": "Aqua Security Software Ltd." }, "group": "aquasecurity", "name": "trivy", "version": "0.69.3" } ] }, "component": { "bom-ref": "pkg:oci/confluent-init-container@sha256%3Aa13e2fada841b3e7cec06b567b8b1673c4f22e8f54e450fa372ff8be7e656522?arch=amd64&repository_url=519856050701.dkr.ecr.us-west-2.amazonaws.com%2Fdocker%2Fprod%2Fconfluentinc%2Fconfluent-init-container", "type": "container", "supplier": { "name": "Confluent" }, "name": "confluent-init-container", "version": "3.2.4", "purl": "pkg:oci/confluent-init-container@sha256%3Aa13e2fada841b3e7cec06b567b8b1673c4f22e8f54e450fa372ff8be7e656522?arch=amd64&repository_url=519856050701.dkr.ecr.us-west-2.amazonaws.com%2Fdocker%2Fprod%2Fconfluentinc%2Fconfluent-init-container", "properties": [ { "name": "aquasecurity:trivy:DiffID", "value": "sha256:0ecd81db99a2f40a53b7ab9c9f9142482ee77d4dcb334b9b73c6219c96897e79" }, { "name": "aquasecurity:trivy:DiffID", "value": "sha256:292df7773a07ac4074a5f93b813019cdcf4edc3811840f1e9ceb86b70c04fada" }, { "name": "aquasecurity:trivy:DiffID", "value": "sha256:370896c5d73dd342d1a23fccfac7a54de5a4cb392a957d6207692c478da81797" }, { "name": "aquasecurity:trivy:DiffID", "value": "sha256:497b30e5bc079c0653e47dead8c1bf6f777856e4b32dfd1a7a7f93c7cd0d4509" }, { "name": "aquasecurity:trivy:DiffID", "value": "sha256:4c81b92f109cf10ad29796edab5c14fb5e4a144c1a09145546c415bd7dba82b3" }, { "name": "aquasecurity:trivy:DiffID", "value": "sha256:4d434782b05d2c6b48da5a3af9f5d9435a9fe176bdbc53aec09a58656441f7e4" }, { "name": "aquasecurity:trivy:DiffID", "value": "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef" }, { "name": "aquasecurity:trivy:DiffID", "value": "sha256:6b0d7765448b06e752ed98f332d01574ffa8c52e45f373d53342349ebc0fe0cf" }, { "name": "aquasecurity:trivy:DiffID", "value": "sha256:767c95abd73723bdc1637eb9edb48d4ed4b0f51ab7ff5f0c679129d9dae71135" }, { "name": "aquasecurity:trivy:DiffID", "value": "sha256:920f44f6a23380ccd31c053e91e17ba6a188d1fe4319911b1cc3fa236cbe649c" }, { "name": "aquasecurity:trivy:DiffID", "value": "sha256:9f41539597ec0fe18331d03201be80d3f8d7e7d6f8e8742d773ae437263636bc" }, { "name": "aquasecurity:trivy:DiffID", "value": "sha256:9fd1d2bad6ad598297483c06dfa3af60bb53fc23ef55688183b167c2c5c44f96" }, { "name": "aquasecurity:trivy:DiffID", "value": "sha256:e14136ca6bae1961965eebc8fe07c848952815448dc9c41fd7c9b278fa88400e" }, { "name": "aquasecurity:trivy:DiffID", "value": "sha256:f82eb422c09cd2c9240ffee3115de1ae72e19bc5e98da02a15ce19150c8b15b9" }, { "name": "aquasecurity:trivy:ImageID", "value": "sha256:1a9c76283422b7011e7d6b40712f25f273ae83f32b926dd60c7002308ebefa56" }, { "name": "aquasecurity:trivy:Labels:architecture", "value": "x86_64" }, { "name": "aquasecurity:trivy:Labels:build-date", "value": "2026-09-14T00:32:05Z" }, { "name": "aquasecurity:trivy:Labels:com.redhat.component", "value": "ubi9-micro-container" }, { "name": "aquasecurity:trivy:Labels:com.redhat.license_terms", "value": "https://www.redhat.com/en/about/red-hat-end-user-license-agreements#UBI" }, { "name": "aquasecurity:trivy:Labels:cpe", "value": "cpe:/a:redhat:enterprise_linux:9::appstream" }, { "name": "aquasecurity:trivy:Labels:description", "value": "Confluent Operator, init-container image" }, { "name": "aquasecurity:trivy:Labels:distribution-scope", "value": "public" }, { "name": "aquasecurity:trivy:Labels:io.buildah.version", "value": "1.44.0" }, { "name": "aquasecurity:trivy:Labels:io.k8s.description", "value": "Confluent Operator, init-container image" }, { "name": "aquasecurity:trivy:Labels:io.k8s.display-name", "value": "Confluent Operator, init-container" }, { "name": "aquasecurity:trivy:Labels:io.openshift.tags", "value": "cfk,confluent-operator,confluent-platform,event-streaming, data-motion" }, { "name": "aquasecurity:trivy:Labels:maintainer", "value": "CFK " }, { "name": "aquasecurity:trivy:Labels:name", "value": "CFK init-container" }, { "name": "aquasecurity:trivy:Labels:org.opencontainers.image.created", "value": "2026-09-22T12:02:59Z" }, { "name": "aquasecurity:trivy:Labels:org.opencontainers.image.revision", "value": "7e3883a94d962fab3fef7ecaad6ea71e21c16282" }, { "name": "aquasecurity:trivy:Labels:org.opencontainers.image.source", "value": "https://github.com/confluentinc/confluent-operator" }, { "name": "aquasecurity:trivy:Labels:org.opencontainers.image.url", "value": "https://semaphore.ci.confluent.io/jobs/89043531-c2a8-499c-8e70-8d2051211398" }, { "name": "aquasecurity:trivy:Labels:org.opencontainers.image.vendor", "value": "Confluent Inc." }, { "name": "aquasecurity:trivy:Labels:org.opencontainers.image.version", "value": "v0.1514.158" }, { "name": "aquasecurity:trivy:Labels:release", "value": "1514" }, { "name": "aquasecurity:trivy:Labels:summary", "value": "Confluent Operator, init-container image" }, { "name": "aquasecurity:trivy:Labels:url", "value": "https://catalog.redhat.com/en/search?searchType=containers" }, { "name": "aquasecurity:trivy:Labels:vcs-ref", "value": "b3f01943b83e7975e01233fc613cb5f0941b57d1" }, { "name": "aquasecurity:trivy:Labels:vcs-type", "value": "git" }, { "name": "aquasecurity:trivy:Labels:vendor", "value": "Confluent, Inc" }, { "name": "aquasecurity:trivy:Labels:version", "value": "v0.1514.158" }, { "name": "aquasecurity:trivy:Labels:version.confluentinc.confluent-init-container", "value": "v0.1514.158" }, { "name": "aquasecurity:trivy:Reference", "value": "519856050701.dkr.ecr.us-west-2.amazonaws.com/docker/prod/confluentinc/confluent-init-container:v0.1514.158-amd64" }, { "name": "aquasecurity:trivy:RepoDigest", "value": "519856050701.dkr.ecr.us-west-2.amazonaws.com/docker/prod/confluentinc/confluent-init-container@sha256:a13e2fada841b3e7cec06b567b8b1673c4f22e8f54e450fa372ff8be7e656522" }, { "name": "aquasecurity:trivy:RepoTag", "value": "519856050701.dkr.ecr.us-west-2.amazonaws.com/docker/prod/confluentinc/confluent-init-container:v0.1514.158-amd64" }, { "name": "aquasecurity:trivy:SchemaVersion", "value": "2" }, { "name": "aquasecurity:trivy:Size", "value": "523590144" } ] } }, "components": [], "dependencies": [], "vulnerabilities": [ { "id": "CVE-2005-2541", "ratings": [ { "source": { "name": "nvd" }, "score": 10, "severity": "high", "method": "CVSSv2", "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C" }, { "source": { "name": "redhat" }, "score": 7, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "description": "Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2005-2541" }, { "url": "http://marc.info/?l=bugtraq&m=112327628230258&w=2" }, { "url": "https://access.redhat.com/security/cve/CVE-2005-2541" }, { "url": "https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c@%3Cissues.guacamole.apache.org%3E" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2005-2541" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2005-2541" } ], "published": "2005-08-10T04:00:00+00:00", "updated": "2026-04-16T00:27:16+00:00", "affects": [ { "ref": "pkg:rpm/redhat/tar@1.34-13.el9_8?arch=x86_64&distro=redhat-9.8&epoch=2", "versions": [ { "version": "2:1.34-13.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/tar@1.34-13.el9_8?arch=x86_64&distro=redhat-9.8&epoch=2" } ] }, { "id": "CVE-2021-31879", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 6.1, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "source": { "name": "nvd" }, "score": 5.8, "severity": "medium", "method": "CVSSv2", "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N" }, { "source": { "name": "nvd" }, "score": 6.1, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 601 ], "description": "GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2021-31879" }, { "url": "https://access.redhat.com/security/cve/CVE-2021-31879" }, { "url": "https://mail.gnu.org/archive/html/bug-wget/2021-02/msg00002.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31879" }, { "url": "https://savannah.gnu.org/bugs/?56909" }, { "url": "https://security.netapp.com/advisory/ntap-20210618-0002/" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2021-31879" } ], "published": "2021-04-29T05:15:08+00:00", "updated": "2026-10-08T21:17:35+00:00", "affects": [ { "ref": "pkg:rpm/redhat/wget@1.21.1-11.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "1.21.1-11.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/wget@1.21.1-11.el9_8?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2021-3572", "ratings": [ { "source": { "name": "alma" }, "severity": "low" }, { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "ghsa" }, "score": 5.7, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N" }, { "source": { "name": "nvd" }, "score": 3.5, "severity": "info", "method": "CVSSv2", "vector": "AV:N/AC:M/Au:S/C:N/I:P/A:N" }, { "source": { "name": "nvd" }, "score": 5.7, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 4.5, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N" }, { "source": { "name": "rocky" }, "severity": "medium" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 20 ], "description": "A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity. This is fixed in python-pip version 21.1.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2021-3572" }, { "url": "https://access.redhat.com/errata/RHSA-2021:3254" }, { "url": "https://access.redhat.com/security/cve/CVE-2021-3572" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1772014" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1928707" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1928904" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1935913" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1941534" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1955615" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1957458" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1962856" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1968074" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18874" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27619" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28493" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20095" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28957" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29921" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33503" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3426" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3572" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42771" }, { "url": "https://errata.rockylinux.org/RLSA-2021:4162" }, { "url": "https://github.com/advisories/GHSA-5xp3-jfq3-5q8x" }, { "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pip/PYSEC-2021-437.yaml" }, { "url": "https://github.com/pypa/pip" }, { "url": "https://github.com/pypa/pip/commit/e46bdda9711392fec0c45c1175bae6db847cb30b" }, { "url": "https://github.com/pypa/pip/issues/10042" }, { "url": "https://github.com/pypa/pip/issues/10042#issuecomment-857452480" }, { "url": "https://github.com/pypa/pip/pull/9827" }, { "url": "https://github.com/skazi0/CVE-2021-3572/blob/master/CVE-2021-3572-v9.0.1.patch" }, { "url": "https://linux.oracle.com/cve/CVE-2021-3572.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2023-12349.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3572" }, { "url": "https://packetstormsecurity.com/files/162712/USN-4961-1.txt" }, { "url": "https://security.netapp.com/advisory/ntap-20240621-0006" }, { "url": "https://security.netapp.com/advisory/ntap-20240621-0006/" }, { "url": "https://ubuntu.com/security/notices/USN-4961-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2021-3572" }, { "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" }, { "url": "https://www.oracle.com/security-alerts/cpujul2022.html" } ], "published": "2021-11-10T18:15:09+00:00", "updated": "2026-10-08T21:17:40+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python3-pip-wheel@21.3.1-2.el9_8?arch=noarch&distro=redhat-9.8", "versions": [ { "version": "21.3.1-2.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-2.el9_8?arch=noarch&distro=redhat-9.8" } ] }, { "id": "CVE-2021-46195", "ratings": [ { "source": { "name": "alma" }, "severity": "low" }, { "source": { "name": "nvd" }, "score": 4.3, "severity": "medium", "method": "CVSSv2", "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P" }, { "source": { "name": "nvd" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "oracle-oval" }, "severity": "low" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 3.3, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 674 ], "description": "GCC v12.0 was discovered to contain an uncontrolled recursion via the component libiberty/rust-demangle.c. This vulnerability allows attackers to cause a Denial of Service (DoS) by consuming excessive CPU and memory resources.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2021-46195" }, { "url": "https://access.redhat.com/errata/RHSA-2022:8415" }, { "url": "https://access.redhat.com/security/cve/CVE-2021-46195" }, { "url": "https://bugzilla.redhat.com/2046300" }, { "url": "https://errata.almalinux.org/9/ALSA-2022-8415.html" }, { "url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103841" }, { "url": "https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=f10bec5ffa487ad3033ed5f38cfd0fc7d696deab" }, { "url": "https://linux.oracle.com/cve/CVE-2021-46195.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2022-8415.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-46195" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2021-46195" } ], "published": "2022-01-14T20:15:15+00:00", "updated": "2026-10-08T22:17:14+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libgcc@11.5.0-14.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "11.5.0-14.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libstdc%2B%2B@11.5.0-14.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "11.5.0-14.el9", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libgcc@11.5.0-14.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libstdc%2B%2B@11.5.0-14.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/libgcc@11.5.0-14.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/libgcc@11.5.0-14.el9?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2022-27943", "ratings": [ { "source": { "name": "amazon" }, "severity": "low" }, { "source": { "name": "nvd" }, "score": 4.3, "severity": "medium", "method": "CVSSv2", "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P" }, { "source": { "name": "nvd" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 5.5, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 674 ], "description": "libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2022-27943" }, { "url": "https://access.redhat.com/security/cve/CVE-2022-27943" }, { "url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039" }, { "url": "https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=1a770b01ef415e114164b6151d1e55acdee09371" }, { "url": "https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=9234cdca6ee88badfc00297e72f13dac4e540c79" }, { "url": "https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=fc968115a742d9e4674d9725ce9c2106b91b6ead" }, { "url": "https://gcc.gnu.org/pipermail/gcc-patches/2022-March/592244.html" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27943" }, { "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=28995" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2022-27943" } ], "published": "2022-03-26T13:15:07+00:00", "updated": "2026-10-08T19:16:56+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libgcc@11.5.0-14.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "11.5.0-14.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libstdc%2B%2B@11.5.0-14.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "11.5.0-14.el9", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libgcc@11.5.0-14.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libstdc%2B%2B@11.5.0-14.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/libgcc@11.5.0-14.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/libgcc@11.5.0-14.el9?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2022-41409", "ratings": [ { "source": { "name": "amazon" }, "severity": "low" }, { "source": { "name": "cbl-mariner" }, "severity": "high" }, { "source": { "name": "julia" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "nvd" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 5.3, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 190 ], "description": "Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2022-41409" }, { "url": "https://access.redhat.com/security/cve/CVE-2022-41409" }, { "url": "https://github.com/PCRE2Project/pcre2/commit/94e1c001761373b7d9450768aa15d04c25547a35" }, { "url": "https://github.com/PCRE2Project/pcre2/issues/141" }, { "url": "https://github.com/advisories/GHSA-4qfx-v7wh-3q4j" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41409" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2022-41409" } ], "published": "2023-07-18T14:15:12+00:00", "updated": "2026-06-17T05:03:09+00:00", "affects": [ { "ref": "pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8", "versions": [ { "version": "10.40-6.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "10.40-6.el9", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2023-24056", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "nvd" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 5.5, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "cwes": [ 787 ], "description": "In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2023-24056" }, { "url": "https://access.redhat.com/security/cve/CVE-2023-24056" }, { "url": "https://gitea.treehouse.systems/ariadne/pkgconf/commit/628b2b2bafa5d3a2017193ddf375093e70666059" }, { "url": "https://github.com/pkgconf/pkgconf/tags" }, { "url": "https://nullprogram.com/blog/2023/01/18/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-24056" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-24056" } ], "published": "2023-01-22T04:15:11+00:00", "updated": "2026-06-17T05:38:34+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libpkgconf@1.7.3-10.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "1.7.3-10.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/pkgconf-m4@1.7.3-10.el9?arch=noarch&distro=redhat-9.8", "versions": [ { "version": "1.7.3-10.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/pkgconf-pkg-config@1.7.3-10.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "1.7.3-10.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/pkgconf@1.7.3-10.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "1.7.3-10.el9", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libpkgconf@1.7.3-10.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/pkgconf-m4@1.7.3-10.el9?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/pkgconf-pkg-config@1.7.3-10.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/pkgconf@1.7.3-10.el9?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2023-32636", "ratings": [ { "source": { "name": "alma" }, "severity": "low" }, { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "cbl-mariner" }, "severity": "high" }, { "source": { "name": "julia" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "nvd" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "oracle-oval" }, "severity": "low" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 6.2, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 400, 502 ], "description": "A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resolve CVE-2023-29499. The offset table validation may be very slow. This bug does not affect any released version of glib but does affect glib distributors who followed the guidance of glib developers to backport the initial fix for CVE-2023-29499.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2023-32636" }, { "url": "https://access.redhat.com/errata/RHSA-2024:2528" }, { "url": "https://access.redhat.com/security/cve/CVE-2023-32636" }, { "url": "https://bugzilla.redhat.com/2211827" }, { "url": "https://bugzilla.redhat.com/2211828" }, { "url": "https://bugzilla.redhat.com/2211829" }, { "url": "https://bugzilla.redhat.com/2211833" }, { "url": "https://discourse.gnome.org/t/multiple-fixes-for-gvariant-normalisation-issues-in-glib/12835" }, { "url": "https://errata.almalinux.org/9/ALSA-2024-2528.html" }, { "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/2841" }, { "url": "https://https://discourse.gnome.org/t/multiple-fixes-for-gvariant-normalisation-issues-in-glib/12835" }, { "url": "https://linux.oracle.com/cve/CVE-2023-32636.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2024-2528.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32636" }, { "url": "https://security.netapp.com/advisory/ntap-20231110-0002/" }, { "url": "https://ubuntu.com/security/notices/USN-6165-1" }, { "url": "https://ubuntu.com/security/notices/USN-6165-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-32636" } ], "published": "2023-09-14T20:15:09+00:00", "updated": "2026-06-17T05:59:16+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glib2@2.68.4-19.el9_8.10?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.68.4-19.el9_8.10", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/glib2@2.68.4-19.el9_8.10?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2023-39804", "ratings": [ { "source": { "name": "amazon" }, "severity": "low" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 6.2, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 3.3, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "description": "In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2023-39804" }, { "url": "https://access.redhat.com/security/cve/CVE-2023-39804" }, { "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1058079" }, { "url": "https://git.savannah.gnu.org/cgit/tar.git/commit/?id=a339f05cd269013fa133d2f148d73f6f7d4247e4" }, { "url": "https://git.savannah.gnu.org/cgit/tar.git/tree/src/xheader.c?h=release_1_34#n1723" }, { "url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00008.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39804" }, { "url": "https://ubuntu.com/security/notices/USN-6543-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-39804" } ], "published": "2024-03-27T04:15:08+00:00", "updated": "2026-06-17T06:12:52+00:00", "affects": [ { "ref": "pkg:rpm/redhat/tar@1.34-13.el9_8?arch=x86_64&distro=redhat-9.8&epoch=2", "versions": [ { "version": "2:1.34-13.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/tar@1.34-13.el9_8?arch=x86_64&distro=redhat-9.8&epoch=2" } ] }, { "id": "CVE-2023-4156", "ratings": [ { "source": { "name": "amazon" }, "severity": "low" }, { "source": { "name": "cbl-mariner" }, "severity": "high" }, { "source": { "name": "nvd" }, "score": 7.1, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 6.1, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 125 ], "description": "A heap out-of-bounds read flaw was found in builtin.c in the gawk package. This issue may lead to a crash and could be used to read sensitive information.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2023-4156" }, { "url": "https://access.redhat.com/security/cve/CVE-2023-4156" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215930" }, { "url": "https://git.savannah.gnu.org/gitweb/?p=gawk.git;a=commitdiff;h=e709eb829448ce040087a3fc5481db6bfcaae212" }, { "url": "https://mail.gnu.org/archive/html/bug-gawk/2022-08/msg00000.html" }, { "url": "https://mail.gnu.org/archive/html/bug-gawk/2022-08/msg00023.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4156" }, { "url": "https://ubuntu.com/security/notices/USN-6373-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-4156" } ], "published": "2023-09-25T18:15:11+00:00", "updated": "2026-06-17T06:37:11+00:00", "affects": [ { "ref": "pkg:rpm/redhat/gawk@5.1.0-6.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "5.1.0-6.el9", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/gawk@5.1.0-6.el9?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2023-45322", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "nvd" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.9, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 416 ], "description": "libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is \"I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when memory allocations fail.\"", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2023-45322" }, { "url": "http://www.openwall.com/lists/oss-security/2023/10/06/5" }, { "url": "https://access.redhat.com/security/cve/CVE-2023-45322" }, { "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/344" }, { "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/583" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45322" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-45322" } ], "published": "2023-10-06T22:15:11+00:00", "updated": "2026-06-17T06:28:37+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.4?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.9.13-14.el9_8.4", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.4?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2023-45803", "ratings": [ { "source": { "name": "alma" }, "severity": "medium" }, { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "ghsa" }, "score": 4.2, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N" }, { "source": { "name": "nvd" }, "score": 4.2, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N" }, { "source": { "name": "oracle-oval" }, "severity": "medium" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 4.2, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N" }, { "source": { "name": "rocky" }, "severity": "medium" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 200 ], "description": "urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body (like `POST`) to `GET` as is required by HTTP RFCs. Although this behavior is not specified in the section for redirects, it can be inferred by piecing together information from different sections and we have observed the behavior in other major HTTP client implementations like curl and web browsers. Because the vulnerability requires a previously trusted service to become compromised in order to have an impact on confidentiality we believe the exploitability of this vulnerability is low. Additionally, many users aren't putting sensitive data in HTTP request bodies, if this is the case then this vulnerability isn't exploitable. Both of the following conditions must be true to be affected by this vulnerability: 1. Using urllib3 and submitting sensitive information in the HTTP request body (such as form data or JSON) and 2. The origin service is compromised and starts redirecting using 301, 302, or 303 to a malicious peer or the redirected-to service becomes compromised. This issue has been addressed in versions 1.26.18 and 2.0.7 and users are advised to update to resolve this issue. Users unable to update should disable redirects for services that aren't expecting to respond with redirects with `redirects=False` and disable automatic redirects with `redirects=False` and handle 301, 302, and 303 redirects manually by stripping the HTTP request body.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2023-45803" }, { "url": "https://access.redhat.com/errata/RHSA-2024:11238" }, { "url": "https://access.redhat.com/errata/RHSA-2024:2132" }, { "url": "https://access.redhat.com/security/cve/CVE-2023-45803" }, { "url": "https://bugzilla.redhat.com/2246840" }, { "url": "https://bugzilla.redhat.com/2257028" }, { "url": "https://bugzilla.redhat.com/2257854" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2246840" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45803" }, { "url": "https://errata.almalinux.org/9/ALSA-2024-2132.html" }, { "url": "https://errata.rockylinux.org/RLSA-2024:11238" }, { "url": "https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2023-212.yaml" }, { "url": "https://github.com/urllib3/urllib3" }, { "url": "https://github.com/urllib3/urllib3/commit/4e50fbc5db74e32cabd5ccc1ab81fc103adfe0b3" }, { "url": "https://github.com/urllib3/urllib3/commit/4e98d57809dacab1cbe625fddeec1a290c478ea9" }, { "url": "https://github.com/urllib3/urllib3/commit/b594c5ceaca38e1ac215f916538fb128e3526a36" }, { "url": "https://github.com/urllib3/urllib3/releases/tag/1.26.18" }, { "url": "https://github.com/urllib3/urllib3/releases/tag/2.0.7" }, { "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-g4mx-q9vg-27p4" }, { "url": "https://linux.oracle.com/cve/CVE-2023-45803.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2024-2988.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00020.html" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4R2Y5XK3WALSR3FNAGN7JBYV2B343ZKB" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4R2Y5XK3WALSR3FNAGN7JBYV2B343ZKB/" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5F5CUBAN5XMEBVBZPHFITBLMJV5FIJJ5" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5F5CUBAN5XMEBVBZPHFITBLMJV5FIJJ5/" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PPDPLM6UUMN55ESPQWJFLLIZY4ZKCNRX" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PPDPLM6UUMN55ESPQWJFLLIZY4ZKCNRX/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45803" }, { "url": "https://ubuntu.com/security/notices/USN-6473-1" }, { "url": "https://ubuntu.com/security/notices/USN-6473-2" }, { "url": "https://ubuntu.com/security/notices/USN-7762-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-45803" }, { "url": "https://www.rfc-editor.org/rfc/rfc9110.html#name-get" } ], "published": "2023-10-17T20:15:10+00:00", "updated": "2026-06-17T06:29:33+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python3-pip-wheel@21.3.1-2.el9_8?arch=noarch&distro=redhat-9.8", "versions": [ { "version": "21.3.1-2.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-2.el9_8?arch=noarch&distro=redhat-9.8" } ] }, { "id": "CVE-2023-50495", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "nvd" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 6.5, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "description": "NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry().", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2023-50495" }, { "url": "https://access.redhat.com/security/cve/CVE-2023-50495" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/" }, { "url": "https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00020.html" }, { "url": "https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00029.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50495" }, { "url": "https://security.netapp.com/advisory/ntap-20240119-0008/" }, { "url": "https://ubuntu.com/security/notices/USN-6684-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-50495" } ], "published": "2023-12-12T15:15:07+00:00", "updated": "2026-06-17T06:39:44+00:00", "affects": [ { "ref": "pkg:rpm/redhat/ncurses-base@6.2-12.20210508.el9?arch=noarch&distro=redhat-9.8", "versions": [ { "version": "6.2-12.20210508.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/ncurses-libs@6.2-12.20210508.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "6.2-12.20210508.el9", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/ncurses-base@6.2-12.20210508.el9?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/ncurses-libs@6.2-12.20210508.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/ncurses-base@6.2-12.20210508.el9?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/ncurses-libs@6.2-12.20210508.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/ncurses-base@6.2-12.20210508.el9?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/ncurses-libs@6.2-12.20210508.el9?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2024-0232", "ratings": [ { "source": { "name": "bitnami" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "nvd" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 4.7, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "cwes": [ 416 ], "description": "A heap use-after-free issue has been identified in SQLite in the jsonParseAddNodeArray() function in sqlite3.c. This flaw allows a local attacker to leverage a victim to pass specially crafted malicious input to the application, potentially causing a crash and leading to a denial of service.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2024-0232" }, { "url": "https://access.redhat.com/security/cve/CVE-2024-0232" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2243754" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDCMYQ3J45NHQ4EJREM3BJNNKB5BK4Y7/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0232" }, { "url": "https://security.netapp.com/advisory/ntap-20240315-0007/" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-0232" } ], "published": "2024-01-16T14:15:48+00:00", "updated": "2026-06-17T06:53:02+00:00", "affects": [ { "ref": "pkg:rpm/redhat/sqlite-libs@3.34.1-11.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.34.1-11.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/sqlite-libs@3.34.1-11.el9_8?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2024-10524", "ratings": [ { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L" }, { "source": { "name": "redhat" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L" } ], "cwes": [ 918 ], "description": "Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2024-10524" }, { "url": "http://www.openwall.com/lists/oss-security/2024/11/18/6" }, { "url": "https://access.redhat.com/security/cve/CVE-2024-10524" }, { "url": "https://git.savannah.gnu.org/cgit/wget.git/commit/?id=c419542d956a2607bbce5df64b9d378a8588d778" }, { "url": "https://github.com/advisories/GHSA-mqrm-h2pw-9j9r" }, { "url": "https://jfrog.com/blog/cve-2024-10524-wget-zero-day-vulnerability" }, { "url": "https://jfrog.com/blog/cve-2024-10524-wget-zero-day-vulnerability/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10524" }, { "url": "https://seclists.org/oss-sec/2024/q4/107" }, { "url": "https://security.netapp.com/advisory/ntap-20250321-0007" }, { "url": "https://security.netapp.com/advisory/ntap-20250321-0007/" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-10524" } ], "published": "2024-11-19T15:15:06+00:00", "updated": "2026-06-17T06:55:51+00:00", "affects": [ { "ref": "pkg:rpm/redhat/wget@1.21.1-11.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "1.21.1-11.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/wget@1.21.1-11.el9_8?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2024-11053", "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "high" }, { "source": { "name": "cbl-mariner" }, "severity": "high" }, { "source": { "name": "julia" }, "score": 3.4, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "photon" }, "severity": "low" }, { "source": { "name": "redhat" }, "score": 5.9, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "source": { "name": "rocky" }, "severity": "high" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "description": "When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, curl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.\n\nThis flaw only manifests itself if the netrc file has an entry that matches\nthe redirect target hostname but the entry either omits just the password or\nomits both login and password.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2024-11053" }, { "url": "http://www.openwall.com/lists/oss-security/2024/12/11/1" }, { "url": "https://access.redhat.com/errata/RHSA-2025:1671" }, { "url": "https://access.redhat.com/security/cve/CVE-2024-11053" }, { "url": "https://bugzilla.redhat.com/2294581" }, { "url": "https://bugzilla.redhat.com/2294676" }, { "url": "https://bugzilla.redhat.com/2301888" }, { "url": "https://bugzilla.redhat.com/2318857" }, { "url": "https://bugzilla.redhat.com/2318858" }, { "url": "https://bugzilla.redhat.com/2318870" }, { "url": "https://bugzilla.redhat.com/2318873" }, { "url": "https://bugzilla.redhat.com/2318874" }, { "url": "https://bugzilla.redhat.com/2318876" }, { "url": "https://bugzilla.redhat.com/2318882" }, { "url": "https://bugzilla.redhat.com/2318883" }, { "url": "https://bugzilla.redhat.com/2318884" }, { "url": "https://bugzilla.redhat.com/2318885" }, { "url": "https://bugzilla.redhat.com/2318886" }, { "url": "https://bugzilla.redhat.com/2318897" }, { "url": "https://bugzilla.redhat.com/2318900" }, { "url": "https://bugzilla.redhat.com/2318905" }, { "url": "https://bugzilla.redhat.com/2318914" }, { "url": "https://bugzilla.redhat.com/2318922" }, { "url": "https://bugzilla.redhat.com/2318923" }, { "url": "https://bugzilla.redhat.com/2318925" }, { "url": "https://bugzilla.redhat.com/2318926" }, { "url": "https://bugzilla.redhat.com/2318927" }, { "url": "https://bugzilla.redhat.com/2331191" }, { "url": "https://bugzilla.redhat.com/2339218" }, { "url": "https://bugzilla.redhat.com/2339220" }, { "url": "https://bugzilla.redhat.com/2339221" }, { "url": "https://bugzilla.redhat.com/2339226" }, { "url": "https://bugzilla.redhat.com/2339231" }, { "url": "https://bugzilla.redhat.com/2339236" }, { "url": "https://bugzilla.redhat.com/2339238" }, { "url": "https://bugzilla.redhat.com/2339243" }, { "url": "https://bugzilla.redhat.com/2339247" }, { "url": "https://bugzilla.redhat.com/2339252" }, { "url": "https://bugzilla.redhat.com/2339259" }, { "url": "https://bugzilla.redhat.com/2339266" }, { "url": "https://bugzilla.redhat.com/2339270" }, { "url": "https://bugzilla.redhat.com/2339271" }, { "url": "https://bugzilla.redhat.com/2339275" }, { "url": "https://bugzilla.redhat.com/2339277" }, { "url": "https://bugzilla.redhat.com/2339281" }, { "url": "https://bugzilla.redhat.com/2339284" }, { "url": "https://bugzilla.redhat.com/2339291" }, { "url": "https://bugzilla.redhat.com/2339293" }, { "url": "https://bugzilla.redhat.com/2339295" }, { "url": "https://bugzilla.redhat.com/2339299" }, { "url": "https://bugzilla.redhat.com/2339300" }, { "url": "https://bugzilla.redhat.com/2339304" }, { "url": "https://bugzilla.redhat.com/2339305" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2294581" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2294676" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2301888" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318857" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318858" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318870" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318873" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318874" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318876" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318882" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318883" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318884" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318885" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318886" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318897" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318900" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318905" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318914" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318922" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318923" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318925" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318926" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318927" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331191" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339218" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339220" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339221" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339226" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339231" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339236" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339238" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339243" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339247" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339252" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339259" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339266" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339270" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339271" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339275" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339277" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339281" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339284" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339291" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339293" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339295" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339299" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339300" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339304" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339305" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://curl.se/docs/CVE-2024-11053.html" }, { "url": "https://curl.se/docs/CVE-2024-11053.json" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-11053" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21193" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21194" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21196" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21197" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21198" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21199" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21201" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21203" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21212" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21213" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21218" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21219" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21230" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21231" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21236" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21237" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21238" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21239" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21241" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21247" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37371" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5535" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7264" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21490" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21491" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21494" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21497" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21500" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21501" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21503" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21504" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21505" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21518" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21519" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21520" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21521" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21522" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21523" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21525" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21529" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21531" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21534" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21536" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21540" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21543" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21546" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21555" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21559" }, { "url": "https://errata.almalinux.org/9/ALSA-2025-1671.html" }, { "url": "https://errata.rockylinux.org/RLSA-2025:1671" }, { "url": "https://github.com/advisories/GHSA-h288-5fq8-5pfw" }, { "url": "https://hackerone.com/reports/2829063" }, { "url": "https://linux.oracle.com/cve/CVE-2024-11053.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2025-1673.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11053" }, { "url": "https://security.netapp.com/advisory/ntap-20250124-0012" }, { "url": "https://security.netapp.com/advisory/ntap-20250124-0012/" }, { "url": "https://security.netapp.com/advisory/ntap-20250131-0003" }, { "url": "https://security.netapp.com/advisory/ntap-20250131-0003/" }, { "url": "https://security.netapp.com/advisory/ntap-20250131-0004" }, { "url": "https://security.netapp.com/advisory/ntap-20250131-0004/" }, { "url": "https://ubuntu.com/security/notices/USN-7162-1" }, { "url": "https://ubuntu.com/security/notices/USN-8525-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-11053" }, { "url": "https://www.oracle.com/security-alerts/cpujan2025.html#AppendixMSQL" } ], "published": "2024-12-11T08:15:05+00:00", "updated": "2026-06-17T06:56:57+00:00", "affects": [ { "ref": "pkg:rpm/redhat/curl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "7.76.1-40.el9_8.7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libcurl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "7.76.1-40.el9_8.7", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/curl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libcurl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2024-13176", "ratings": [ { "source": { "name": "alma" }, "severity": "medium" }, { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 4.1, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" }, { "source": { "name": "oracle-oval" }, "severity": "medium" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 4.7, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "source": { "name": "rocky" }, "severity": "medium" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 385 ], "description": "Issue summary: A timing side-channel which could potentially allow recovering\nthe private key exists in the ECDSA signature computation.\n\nImpact summary: A timing side-channel in ECDSA signature computations\ncould allow recovering the private key by an attacker. However, measuring\nthe timing would require either local access to the signing application or\na very fast network connection with low latency.\n\nThere is a timing signal of around 300 nanoseconds when the top word of\nthe inverted ECDSA nonce value is zero. This can happen with significant\nprobability only for some of the supported elliptic curves. In particular\nthe NIST P-521 curve is affected. To be able to measure this leak, the attacker\nprocess must either be located in the same physical computer or must\nhave a very fast network connection with low latency. For that reason\nthe severity of this vulnerability is Low.\n\nThe FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2024-13176" }, { "url": "http://www.openwall.com/lists/oss-security/2025/01/20/2" }, { "url": "https://access.redhat.com/errata/RHSA-2025:15699" }, { "url": "https://access.redhat.com/errata/RHSA-2025:16046" }, { "url": "https://access.redhat.com/security/cve/CVE-2024-13176" }, { "url": "https://bugzilla.redhat.com/2359885" }, { "url": "https://bugzilla.redhat.com/2359888" }, { "url": "https://bugzilla.redhat.com/2359892" }, { "url": "https://bugzilla.redhat.com/2359894" }, { "url": "https://bugzilla.redhat.com/2359895" }, { "url": "https://bugzilla.redhat.com/2359899" }, { "url": "https://bugzilla.redhat.com/2359900" }, { "url": "https://bugzilla.redhat.com/2359902" }, { "url": "https://bugzilla.redhat.com/2359903" }, { "url": "https://bugzilla.redhat.com/2359911" }, { "url": "https://bugzilla.redhat.com/2359918" }, { "url": "https://bugzilla.redhat.com/2359920" }, { "url": "https://bugzilla.redhat.com/2359924" }, { "url": "https://bugzilla.redhat.com/2359928" }, { "url": "https://bugzilla.redhat.com/2359930" }, { "url": "https://bugzilla.redhat.com/2359932" }, { "url": "https://bugzilla.redhat.com/2359934" }, { "url": "https://bugzilla.redhat.com/2359938" }, { "url": "https://bugzilla.redhat.com/2359940" }, { "url": "https://bugzilla.redhat.com/2359943" }, { "url": "https://bugzilla.redhat.com/2359944" }, { "url": "https://bugzilla.redhat.com/2359945" }, { "url": "https://bugzilla.redhat.com/2359947" }, { "url": "https://bugzilla.redhat.com/2359950" }, { "url": "https://bugzilla.redhat.com/2359963" }, { "url": "https://bugzilla.redhat.com/2359964" }, { "url": "https://bugzilla.redhat.com/2359972" }, { "url": "https://bugzilla.redhat.com/2370920" }, { "url": "https://bugzilla.redhat.com/2380264" }, { "url": "https://bugzilla.redhat.com/2380273" }, { "url": "https://bugzilla.redhat.com/2380274" }, { "url": "https://bugzilla.redhat.com/2380278" }, { "url": "https://bugzilla.redhat.com/2380280" }, { "url": "https://bugzilla.redhat.com/2380283" }, { "url": "https://bugzilla.redhat.com/2380284" }, { "url": "https://bugzilla.redhat.com/2380290" }, { "url": "https://bugzilla.redhat.com/2380291" }, { "url": "https://bugzilla.redhat.com/2380295" }, { "url": "https://bugzilla.redhat.com/2380298" }, { "url": "https://bugzilla.redhat.com/2380306" }, { "url": "https://bugzilla.redhat.com/2380308" }, { "url": "https://bugzilla.redhat.com/2380309" }, { "url": "https://bugzilla.redhat.com/2380310" }, { "url": "https://bugzilla.redhat.com/2380312" }, { "url": "https://bugzilla.redhat.com/2380313" }, { "url": "https://bugzilla.redhat.com/2380320" }, { "url": "https://bugzilla.redhat.com/2380321" }, { "url": "https://bugzilla.redhat.com/2380322" }, { "url": "https://bugzilla.redhat.com/2380326" }, { "url": "https://bugzilla.redhat.com/2380327" }, { "url": "https://bugzilla.redhat.com/2380334" }, { "url": "https://bugzilla.redhat.com/2380335" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2338999" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359885" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359888" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359892" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359894" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359895" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359899" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359900" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359902" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359903" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359911" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359918" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359920" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359924" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359928" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359930" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359932" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359934" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359938" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359940" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359943" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359944" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359945" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359947" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359950" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359963" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359964" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359972" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370920" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380264" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380273" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380274" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380278" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380280" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380283" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380284" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380290" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380291" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380295" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380298" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380306" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380308" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380309" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380310" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380312" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380313" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380320" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380321" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380322" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380326" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380327" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380334" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380335" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-13176" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21574" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21575" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21577" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21579" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21580" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21581" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21584" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21585" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21588" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30681" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30682" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30683" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30684" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30685" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30687" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30688" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30689" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30693" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30695" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30696" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30699" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30703" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30704" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30705" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30715" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30721" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30722" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50077" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50078" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50079" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50080" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50081" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50082" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50083" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50084" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50085" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50086" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50087" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50088" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50091" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50092" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50093" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50094" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50096" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50097" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50098" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50099" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50100" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50101" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50102" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50104" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5399" }, { "url": "https://errata.almalinux.org/9/ALSA-2025-16046.html" }, { "url": "https://errata.rockylinux.org/RLSA-2025:15699" }, { "url": "https://github.com/advisories/GHSA-r9fv-h47r-823f" }, { "url": "https://github.com/openssl/openssl/commit/07272b05b04836a762b4baa874958af51d513844" }, { "url": "https://github.com/openssl/openssl/commit/2af62e74fb59bc469506bc37eb2990ea408d9467" }, { "url": "https://github.com/openssl/openssl/commit/392dcb336405a0c94486aa6655057f59fd3a0902" }, { "url": "https://github.com/openssl/openssl/commit/4b1cb94a734a7d4ec363ac0a215a25c181e11f65" }, { "url": "https://github.com/openssl/openssl/commit/77c608f4c8857e63e98e66444e2e761c9627916f" }, { "url": "https://github.openssl.org/openssl/extended-releases/commit/0d5fd1ab987f7571e2c955d8d8b638fc0fb54ded" }, { "url": "https://github.openssl.org/openssl/extended-releases/commit/a2639000db19878d5d89586ae7b725080592ae86" }, { "url": "https://linux.oracle.com/cve/CVE-2024-13176.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2025-16046.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00028.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13176" }, { "url": "https://openssl-library.org/news/secadv/20250120.txt" }, { "url": "https://security.netapp.com/advisory/ntap-20250124-0005" }, { "url": "https://security.netapp.com/advisory/ntap-20250124-0005/" }, { "url": "https://security.netapp.com/advisory/ntap-20250418-0010" }, { "url": "https://security.netapp.com/advisory/ntap-20250418-0010/" }, { "url": "https://security.netapp.com/advisory/ntap-20250502-0006" }, { "url": "https://security.netapp.com/advisory/ntap-20250502-0006/" }, { "url": "https://ubuntu.com/security/notices/USN-7264-1" }, { "url": "https://ubuntu.com/security/notices/USN-7278-1" }, { "url": "https://ubuntu.com/security/notices/USN-7894-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-13176" }, { "url": "https://www.oracle.com/security-alerts/cpuapr2025.html#AppendixMSQL" } ], "published": "2025-01-20T14:15:26+00:00", "updated": "2026-06-17T07:01:23+00:00", "affects": [ { "ref": "pkg:rpm/redhat/openssl-libs@3.5.8-1.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1", "versions": [ { "version": "1:3.5.8-1.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/openssl-libs@3.5.8-1.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1" } ] }, { "id": "CVE-2024-41996", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.9, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 295 ], "description": "Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2024-41996" }, { "url": "https://access.redhat.com/security/cve/CVE-2024-41996" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-089022.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-485750.html" }, { "url": "https://dheatattack.gitlab.io/details/" }, { "url": "https://dheatattack.gitlab.io/faq/" }, { "url": "https://gist.github.com/c0r0n3r/abccc14d4d96c0442f3a77fa5ca255d1" }, { "url": "https://github.com/openssl/openssl/issues/17374" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41996" }, { "url": "https://openssl-library.org/post/2022-10-21-tls-groups-configuration/" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-41996" } ], "published": "2024-08-26T06:15:04+00:00", "updated": "2026-06-17T07:48:36+00:00", "affects": [ { "ref": "pkg:rpm/redhat/openssl-libs@3.5.8-1.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1", "versions": [ { "version": "1:3.5.8-1.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/openssl-libs@3.5.8-1.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1" } ] }, { "id": "CVE-2024-7264", "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "nvd" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.3, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H" }, { "source": { "name": "rocky" }, "severity": "high" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 125 ], "description": "libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an\nASN.1 Generalized Time field. If given an syntactically incorrect field, the\nparser might end up using -1 for the length of the *time fraction*, leading to\na `strlen()` getting performed on a pointer to a heap buffer area that is not\n(purposely) null terminated.\n\nThis flaw most likely leads to a crash, but can also lead to heap contents\ngetting returned to the application when\n[CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2024-7264" }, { "url": "http://www.openwall.com/lists/oss-security/2024/07/31/1" }, { "url": "https://access.redhat.com/errata/RHSA-2025:1671" }, { "url": "https://access.redhat.com/security/cve/CVE-2024-7264" }, { "url": "https://bugzilla.redhat.com/2294581" }, { "url": "https://bugzilla.redhat.com/2294676" }, { "url": "https://bugzilla.redhat.com/2301888" }, { "url": "https://bugzilla.redhat.com/2318857" }, { "url": "https://bugzilla.redhat.com/2318858" }, { "url": "https://bugzilla.redhat.com/2318870" }, { "url": "https://bugzilla.redhat.com/2318873" }, { "url": "https://bugzilla.redhat.com/2318874" }, { "url": "https://bugzilla.redhat.com/2318876" }, { "url": "https://bugzilla.redhat.com/2318882" }, { "url": "https://bugzilla.redhat.com/2318883" }, { "url": "https://bugzilla.redhat.com/2318884" }, { "url": "https://bugzilla.redhat.com/2318885" }, { "url": "https://bugzilla.redhat.com/2318886" }, { "url": "https://bugzilla.redhat.com/2318897" }, { "url": "https://bugzilla.redhat.com/2318900" }, { "url": "https://bugzilla.redhat.com/2318905" }, { "url": "https://bugzilla.redhat.com/2318914" }, { "url": "https://bugzilla.redhat.com/2318922" }, { "url": "https://bugzilla.redhat.com/2318923" }, { "url": "https://bugzilla.redhat.com/2318925" }, { "url": "https://bugzilla.redhat.com/2318926" }, { "url": "https://bugzilla.redhat.com/2318927" }, { "url": "https://bugzilla.redhat.com/2331191" }, { "url": "https://bugzilla.redhat.com/2339218" }, { "url": "https://bugzilla.redhat.com/2339220" }, { "url": "https://bugzilla.redhat.com/2339221" }, { "url": "https://bugzilla.redhat.com/2339226" }, { "url": "https://bugzilla.redhat.com/2339231" }, { "url": "https://bugzilla.redhat.com/2339236" }, { "url": "https://bugzilla.redhat.com/2339238" }, { "url": "https://bugzilla.redhat.com/2339243" }, { "url": "https://bugzilla.redhat.com/2339247" }, { "url": "https://bugzilla.redhat.com/2339252" }, { "url": "https://bugzilla.redhat.com/2339259" }, { "url": "https://bugzilla.redhat.com/2339266" }, { "url": "https://bugzilla.redhat.com/2339270" }, { "url": "https://bugzilla.redhat.com/2339271" }, { "url": "https://bugzilla.redhat.com/2339275" }, { "url": "https://bugzilla.redhat.com/2339277" }, { "url": "https://bugzilla.redhat.com/2339281" }, { "url": "https://bugzilla.redhat.com/2339284" }, { "url": "https://bugzilla.redhat.com/2339291" }, { "url": "https://bugzilla.redhat.com/2339293" }, { "url": "https://bugzilla.redhat.com/2339295" }, { "url": "https://bugzilla.redhat.com/2339299" }, { "url": "https://bugzilla.redhat.com/2339300" }, { "url": "https://bugzilla.redhat.com/2339304" }, { "url": "https://bugzilla.redhat.com/2339305" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2294581" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2294676" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2301888" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318857" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318858" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318870" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318873" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318874" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318876" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318882" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318883" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318884" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318885" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318886" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318897" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318900" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318905" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318914" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318922" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318923" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318925" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318926" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318927" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331191" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339218" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339220" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339221" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339226" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339231" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339236" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339238" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339243" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339247" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339252" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339259" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339266" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339270" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339271" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339275" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339277" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339281" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339284" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339291" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339293" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339295" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339299" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339300" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339304" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339305" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://curl.se/docs/CVE-2024-7264.html" }, { "url": "https://curl.se/docs/CVE-2024-7264.json" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-11053" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21193" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21194" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21196" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21197" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21198" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21199" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21201" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21203" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21212" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21213" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21218" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21219" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21230" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21231" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21236" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21237" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21238" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21239" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21241" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21247" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37371" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5535" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7264" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21490" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21491" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21494" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21497" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21500" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21501" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21503" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21504" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21505" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21518" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21519" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21520" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21521" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21522" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21523" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21525" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21529" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21531" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21534" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21536" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21540" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21543" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21546" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21555" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21559" }, { "url": "https://errata.almalinux.org/9/ALSA-2025-1671.html" }, { "url": "https://errata.rockylinux.org/RLSA-2025:1671" }, { "url": "https://github.com/curl/curl/commit/27959ecce75cdb2809c0bdb3286e60e08fadb519" }, { "url": "https://hackerone.com/reports/2629968" }, { "url": "https://linux.oracle.com/cve/CVE-2024-7264.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2025-1673.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7264" }, { "url": "https://security.netapp.com/advisory/ntap-20240828-0008/" }, { "url": "https://security.netapp.com/advisory/ntap-20241025-0006/" }, { "url": "https://security.netapp.com/advisory/ntap-20241025-0010/" }, { "url": "https://ubuntu.com/security/notices/USN-6944-1" }, { "url": "https://ubuntu.com/security/notices/USN-6944-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-7264" }, { "url": "https://www.oracle.com/security-alerts/cpuoct2024.html#AppendixMSQL" } ], "published": "2024-07-31T08:15:02+00:00", "updated": "2026-06-17T08:19:43+00:00", "affects": [ { "ref": "pkg:rpm/redhat/curl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "7.76.1-40.el9_8.7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libcurl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "7.76.1-40.el9_8.7", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/curl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libcurl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2024-9681", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L" }, { "source": { "name": "nvd" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 3.9, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 697 ], "description": "When curl is asked to use HSTS, the expiry time for a subdomain might\noverwrite a parent domain's cache entry, making it end sooner or later than\notherwise intended.\n\nThis affects curl using applications that enable HSTS and use URLs with the\ninsecure `HTTP://` scheme and perform transfers with hosts like\n`x.example.com` as well as `example.com` where the first host is a subdomain\nof the second host.\n\n(The HSTS cache either needs to have been populated manually or there needs to\nhave been previous HTTPS accesses done as the cache needs to have entries for\nthe domains involved to trigger this problem.)\n\nWhen `x.example.com` responds with `Strict-Transport-Security:` headers, this\nbug can make the subdomain's expiry timeout *bleed over* and get set for the\nparent domain `example.com` in curl's HSTS cache.\n\nThe result of a triggered bug is that HTTP accesses to `example.com` get\nconverted to HTTPS for a different period of time than what was asked for by\nthe origin server. If `example.com` for example stops supporting HTTPS at its\nexpiry time, curl might then fail to access `http://example.com` until the\n(wrongly set) timeout expires. This bug can also expire the parent's entry\n*earlier*, thus making curl inadvertently switch back to insecure HTTP earlier\nthan otherwise intended.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2024-9681" }, { "url": "http://seclists.org/fulldisclosure/2025/Apr/10" }, { "url": "http://seclists.org/fulldisclosure/2025/Apr/11" }, { "url": "http://seclists.org/fulldisclosure/2025/Apr/12" }, { "url": "http://seclists.org/fulldisclosure/2025/Apr/13" }, { "url": "http://seclists.org/fulldisclosure/2025/Apr/4" }, { "url": "http://seclists.org/fulldisclosure/2025/Apr/5" }, { "url": "http://seclists.org/fulldisclosure/2025/Apr/8" }, { "url": "http://seclists.org/fulldisclosure/2025/Apr/9" }, { "url": "http://www.openwall.com/lists/oss-security/2024/11/06/2" }, { "url": "https://access.redhat.com/security/cve/CVE-2024-9681" }, { "url": "https://curl.se/docs/CVE-2024-9681.html" }, { "url": "https://curl.se/docs/CVE-2024-9681.json" }, { "url": "https://github.com/advisories/GHSA-g337-g667-mjvw" }, { "url": "https://hackerone.com/reports/2764830" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9681" }, { "url": "https://security.netapp.com/advisory/ntap-20241213-0006" }, { "url": "https://security.netapp.com/advisory/ntap-20241213-0006/" }, { "url": "https://ubuntu.com/security/notices/USN-7104-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-9681" } ], "published": "2024-11-06T08:15:03+00:00", "updated": "2026-06-17T08:25:03+00:00", "affects": [ { "ref": "pkg:rpm/redhat/curl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "7.76.1-40.el9_8.7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libcurl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "7.76.1-40.el9_8.7", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/curl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libcurl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2025-11468", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 4.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 93 ], "description": "When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-11468" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-11468" }, { "url": "https://github.com/python/cpython/commit/003b8315669b9f08b1010a49071f73f15f818094" }, { "url": "https://github.com/python/cpython/commit/17d1490aa97bd6b98a42b1a9b324ead84e7fd8a2" }, { "url": "https://github.com/python/cpython/commit/61614a5e5056e4f61ced65008d4576f3df34acb6" }, { "url": "https://github.com/python/cpython/commit/a76e4cd62dd68e7cbe86e37e6ed988495a646b66" }, { "url": "https://github.com/python/cpython/commit/e9970f077240c7c670e8a6fc6662f2b30d3b6ad0" }, { "url": "https://github.com/python/cpython/commit/f738386838021c762efea6c9802c82de65e87796" }, { "url": "https://github.com/python/cpython/issues/143935" }, { "url": "https://github.com/python/cpython/pull/143936" }, { "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/FELSEOLBI2QR6YLG6Q7VYF7FWSGQTKLI/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11468" }, { "url": "https://ubuntu.com/security/notices/USN-8018-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-11468" } ], "published": "2026-01-20T22:15:50+00:00", "updated": "2026-06-17T08:30:31+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2025-12781", "ratings": [ { "source": { "name": "nvd" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "source": { "name": "redhat" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" } ], "cwes": [ 704 ], "description": "When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the \"base64\" module the characters \"+/\" will always be accepted, regardless of the value of \"altchars\" parameter, typically used to establish an \"alternative base64 alphabet\" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.\n\n\n\n\nThis behavior can only be insecure if your application uses an alternate base64 alphabet (without \"+/\"). If your application does not use the \"altchars\" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.\n\n\n\n\nThe attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python.\u00a0Users are recommended to mitigate by verifying user-controlled inputs match the base64 \nalphabet they are expecting or verify that their application would not be \naffected if the b64decode() functions accepted \"+\" or \"/\" outside of altchars.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-12781" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-12781" }, { "url": "https://github.com/python/cpython/commit/13360efd385d1a7d0659beba03787ea3d063ef9b" }, { "url": "https://github.com/python/cpython/commit/1be80bec7960f5ccd059e75f3dfbd45fca302947" }, { "url": "https://github.com/python/cpython/commit/9060b4abbe475591b6230b23c2afefeff26fcca5" }, { "url": "https://github.com/python/cpython/commit/e95e783dff443b68e8179fdb57737025bf02ba76" }, { "url": "https://github.com/python/cpython/commit/fd17ee026fa9b67f6288cbafe374a3e479fe03a5" }, { "url": "https://github.com/python/cpython/issues/125346" }, { "url": "https://github.com/python/cpython/pull/141128" }, { "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/KRI7GC6S27YV5NJ4FPDALS2WI5ENAFJ6/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12781" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-12781" } ], "published": "2026-01-21T20:16:04+00:00", "updated": "2026-06-17T08:32:56+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2025-13034", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 6.8, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 295 ], "description": "When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey`\nwith the curl tool, curl should check the public key of the server certificate\nto verify the peer.\n\nThis check was skipped in a certain condition that would then make curl allow\nthe connection without performing the proper check, thus not noticing a\npossible impostor. To skip this check, the connection had to be done with QUIC\nwith ngtcp2 built to use GnuTLS and the user had to explicitly disable the\nstandard certificate verification.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-13034" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-13034" }, { "url": "https://curl.se/docs/CVE-2025-13034.html" }, { "url": "https://curl.se/docs/CVE-2025-13034.json" }, { "url": "https://github.com/advisories/GHSA-9r76-qj98-jfhc" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13034" }, { "url": "https://ubuntu.com/security/notices/USN-8062-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-13034" } ], "published": "2026-01-08T10:15:45+00:00", "updated": "2026-09-15T07:16:23+00:00", "affects": [ { "ref": "pkg:rpm/redhat/curl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "7.76.1-40.el9_8.7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libcurl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "7.76.1-40.el9_8.7", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/curl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libcurl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2025-13462", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "nvd" }, "score": 3.3, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" }, { "source": { "name": "photon" }, "severity": "low" }, { "source": { "name": "redhat" }, "score": 2.5, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 20, 74, 434 ], "description": "The \"tarfile\" module would still apply normalization of AREGTYPE (\\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-13462" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-13462" }, { "url": "https://github.com/python/cpython/commit/42d754e34c06e57ad6b8e7f92f32af679912d8ab" }, { "url": "https://github.com/python/cpython/commit/72dde1016493c52abe857fc4a7bf6c40138b4114" }, { "url": "https://github.com/python/cpython/commit/7ad3093d76a748af55bdb1d2e8aad3638163b017" }, { "url": "https://github.com/python/cpython/commit/9a23b753552afa28e3a2f4d8863572fc66479406" }, { "url": "https://github.com/python/cpython/commit/ae99fe3a33b43e303a05f012815cef60b611a9c7" }, { "url": "https://github.com/python/cpython/commit/d10950739a78f54d0718d88fb5a868374603c084" }, { "url": "https://github.com/python/cpython/issues/141707" }, { "url": "https://github.com/python/cpython/pull/143934" }, { "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/EOMI5I66ZMKQ2INNFT6T7IAIKUGPZYIE/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13462" }, { "url": "https://ubuntu.com/security/notices/USN-8509-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-13462" } ], "published": "2026-03-12T18:16:21+00:00", "updated": "2026-08-13T01:16:50+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2025-13837", "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "bitnami" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "nvd" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H" }, { "source": { "name": "rocky" }, "severity": "high" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 400 ], "description": "When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-13837" }, { "url": "https://access.redhat.com/errata/RHSA-2026:19177" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-13837" }, { "url": "https://bugzilla.redhat.com/2395108" }, { "url": "https://bugzilla.redhat.com/2408891" }, { "url": "https://bugzilla.redhat.com/2418084" }, { "url": "https://bugzilla.redhat.com/2431366" }, { "url": "https://bugzilla.redhat.com/2431374" }, { "url": "https://bugzilla.redhat.com/2444691" }, { "url": "https://bugzilla.redhat.com/2448168" }, { "url": "https://bugzilla.redhat.com/2448181" }, { "url": "https://bugzilla.redhat.com/2449649" }, { "url": "https://bugzilla.redhat.com/2457409" }, { "url": "https://bugzilla.redhat.com/2457932" }, { "url": "https://bugzilla.redhat.com/2458049" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2395108" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2408891" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418084" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431366" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431374" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444691" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448168" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448181" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449649" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457409" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457932" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458049" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13837" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15282" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59375" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6075" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0672" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1502" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2297" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3644" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4224" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4519" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4786" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6100" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-19177.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:19177" }, { "url": "https://github.com/python/cpython/commit/568342cfc8f002d9a15f30238f26b9d2e0e79036" }, { "url": "https://github.com/python/cpython/commit/5a8b19677d818fb41ee55f310233772e15aa1a2b" }, { "url": "https://github.com/python/cpython/commit/694922cf40aa3a28f898b5f5ee08b71b4922df70" }, { "url": "https://github.com/python/cpython/commit/71fa8eb8233b37f16c88b6e3e583b461b205d1ba" }, { "url": "https://github.com/python/cpython/commit/b64441e4852383645af5b435411a6f849dd1b4cb" }, { "url": "https://github.com/python/cpython/commit/cefee7d118a26ef6cd43db59bb9d98ca9a331111" }, { "url": "https://github.com/python/cpython/issues/119342" }, { "url": "https://github.com/python/cpython/pull/119343" }, { "url": "https://linux.oracle.com/cve/CVE-2025-13837.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-19177.html" }, { "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/2X5IBCJXRQAZ5PSERLHMSJFBHFR3QM2C/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13837" }, { "url": "https://ubuntu.com/security/notices/USN-8018-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-13837" } ], "published": "2025-12-01T18:16:04+00:00", "updated": "2026-09-03T03:15:21+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2025-14017", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 6.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 4.8, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 567 ], "description": "When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl,\nchanging TLS options in one thread would inadvertently change them globally\nand therefore possibly also affect other concurrently setup transfers.\n\nDisabling certificate verification for a specific transfer could\nunintentionally disable the feature for other threads as well.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-14017" }, { "url": "http://www.openwall.com/lists/oss-security/2026/01/07/3" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-14017" }, { "url": "https://curl.se/docs/CVE-2025-14017.html" }, { "url": "https://curl.se/docs/CVE-2025-14017.json" }, { "url": "https://github.com/advisories/GHSA-jh4h-2cg6-889h" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14017" }, { "url": "https://ubuntu.com/security/notices/USN-8062-1" }, { "url": "https://ubuntu.com/security/notices/USN-8062-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-14017" } ], "published": "2026-01-08T10:15:45+00:00", "updated": "2026-09-15T07:16:23+00:00", "affects": [ { "ref": "pkg:rpm/redhat/curl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "7.76.1-40.el9_8.7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libcurl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "7.76.1-40.el9_8.7", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/curl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libcurl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2025-14524", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 6.5, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 522, 601 ], "description": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,\nPOP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new\ntarget host.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-14524" }, { "url": "http://www.openwall.com/lists/oss-security/2026/01/07/4" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-14524" }, { "url": "https://curl.se/docs/CVE-2025-14524.html" }, { "url": "https://curl.se/docs/CVE-2025-14524.json" }, { "url": "https://github.com/advisories/GHSA-g897-jvjx-78vg" }, { "url": "https://hackerone.com/reports/3459417" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14524" }, { "url": "https://ubuntu.com/security/notices/USN-8062-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-14524" } ], "published": "2026-01-08T10:15:46+00:00", "updated": "2026-09-15T07:16:24+00:00", "affects": [ { "ref": "pkg:rpm/redhat/curl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "7.76.1-40.el9_8.7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libcurl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "7.76.1-40.el9_8.7", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/curl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libcurl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2025-15079", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 8.1, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 297 ], "description": "When doing SSH-based transfers using either SCP or SFTP, and setting the\nknown_hosts file, libcurl could still mistakenly accept connecting to hosts\n*not present* in the specified file if they were added as recognized in the\nlibssh *global* known_hosts file.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-15079" }, { "url": "http://www.openwall.com/lists/oss-security/2026/01/07/6" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-15079" }, { "url": "https://curl.se/docs/CVE-2025-15079.html" }, { "url": "https://curl.se/docs/CVE-2025-15079.json" }, { "url": "https://github.com/advisories/GHSA-7q9p-cx8r-rh2q" }, { "url": "https://hackerone.com/reports/3477116" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15079" }, { "url": "https://ubuntu.com/security/notices/USN-8062-1" }, { "url": "https://ubuntu.com/security/notices/USN-8062-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-15079" } ], "published": "2026-01-08T10:15:47+00:00", "updated": "2026-09-15T07:16:24+00:00", "affects": [ { "ref": "pkg:rpm/redhat/curl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "7.76.1-40.el9_8.7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libcurl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "7.76.1-40.el9_8.7", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/curl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libcurl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2025-15224", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 3.1, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N" }, { "source": { "name": "photon" }, "severity": "low" }, { "source": { "name": "redhat" }, "score": 4.7, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 287 ], "description": "When doing SSH-based transfers using either SCP or SFTP, and asked to do\npublic key authentication, curl would wrongly still ask and authenticate using\na locally running SSH agent.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-15224" }, { "url": "http://www.openwall.com/lists/oss-security/2026/01/07/7" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-15224" }, { "url": "https://curl.se/docs/CVE-2025-15224.html" }, { "url": "https://curl.se/docs/CVE-2025-15224.json" }, { "url": "https://github.com/advisories/GHSA-hccr-q52r-4w88" }, { "url": "https://hackerone.com/reports/3480925" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15224" }, { "url": "https://ubuntu.com/security/notices/USN-8062-1" }, { "url": "https://ubuntu.com/security/notices/USN-8062-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-15224" } ], "published": "2026-01-08T10:15:47+00:00", "updated": "2026-09-15T07:16:24+00:00", "affects": [ { "ref": "pkg:rpm/redhat/curl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "7.76.1-40.el9_8.7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libcurl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "7.76.1-40.el9_8.7", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/curl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libcurl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2025-15282", "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 4.8, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N" }, { "source": { "name": "rocky" }, "severity": "high" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 93 ], "description": "User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-15282" }, { "url": "https://access.redhat.com/errata/RHSA-2026:19177" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-15282" }, { "url": "https://bugzilla.redhat.com/2395108" }, { "url": "https://bugzilla.redhat.com/2408891" }, { "url": "https://bugzilla.redhat.com/2418084" }, { "url": "https://bugzilla.redhat.com/2431366" }, { "url": "https://bugzilla.redhat.com/2431374" }, { "url": "https://bugzilla.redhat.com/2444691" }, { "url": "https://bugzilla.redhat.com/2448168" }, { "url": "https://bugzilla.redhat.com/2448181" }, { "url": "https://bugzilla.redhat.com/2449649" }, { "url": "https://bugzilla.redhat.com/2457409" }, { "url": "https://bugzilla.redhat.com/2457932" }, { "url": "https://bugzilla.redhat.com/2458049" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2395108" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2408891" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418084" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431366" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431374" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444691" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448168" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448181" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449649" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457409" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457932" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458049" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13837" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15282" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59375" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6075" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0672" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1502" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2297" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3644" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4224" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4519" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4786" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6100" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-19177.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:19177" }, { "url": "https://github.com/python/cpython/commit/05356b1cc153108aaf27f3b72ce438af4aa218c0" }, { "url": "https://github.com/python/cpython/commit/34d76b00dabde81a793bd06dd8ecb057838c4b38" }, { "url": "https://github.com/python/cpython/commit/3f396ca9d7bbe2a50ea6b8c9b27c0082884d9f80" }, { "url": "https://github.com/python/cpython/commit/4ed11d3cd288e6b90196a15c5a825a45d318fe47" }, { "url": "https://github.com/python/cpython/commit/a35ca3be5842505dab74dc0b90b89cde0405017a" }, { "url": "https://github.com/python/cpython/commit/f25509e78e8be6ea73c811ac2b8c928c28841b9f" }, { "url": "https://github.com/python/cpython/issues/143925" }, { "url": "https://github.com/python/cpython/pull/143926" }, { "url": "https://linux.oracle.com/cve/CVE-2025-15282.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-19177.html" }, { "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/X66HL7SISGJT33J53OHXMZT4DFLMHVKF/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15282" }, { "url": "https://ubuntu.com/security/notices/USN-8018-1" }, { "url": "https://ubuntu.com/security/notices/USN-8018-3" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-15282" } ], "published": "2026-01-20T22:15:50+00:00", "updated": "2026-06-17T08:37:31+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2025-1795", "ratings": [ { "source": { "name": "amazon" }, "severity": "low" }, { "source": { "name": "cbl-mariner" }, "severity": "low" }, { "source": { "name": "photon" }, "severity": "low" }, { "source": { "name": "redhat" }, "score": 3.1, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 116 ], "description": "During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded then the separator itself is also unicode-encoded. Expected behavior is that the separating comma remains a plan comma. This can result in the address header being misinterpreted by some mail servers.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-1795" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-1795" }, { "url": "https://github.com/python/cpython/commit/09fab93c3d857496c0bd162797fab816c311ee48" }, { "url": "https://github.com/python/cpython/commit/70754d21c288535e86070ca7a6e90dcb670b8593" }, { "url": "https://github.com/python/cpython/commit/9148b77e0af91cdacaa7fe3dfac09635c3fe9a74" }, { "url": "https://github.com/python/cpython/commit/a4ef689ce670684ec132204b1cd03720c8e0a03d" }, { "url": "https://github.com/python/cpython/commit/d4df3c55e4c5513947f907f24766b34d2ae8c090" }, { "url": "https://github.com/python/cpython/issues/100884" }, { "url": "https://github.com/python/cpython/pull/100885" }, { "url": "https://github.com/python/cpython/pull/119099" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html" }, { "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/MB62IZMEC3UM6SGHP5LET5JX2Y7H4ZUR/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1795" }, { "url": "https://ubuntu.com/security/notices/USN-7570-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-1795" } ], "published": "2025-02-28T19:15:36+00:00", "updated": "2026-07-31T14:16:44+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2025-27113", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "bitnami" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "cbl-mariner" }, "severity": "low" }, { "source": { "name": "julia" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "nvd" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 3.1, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 476 ], "description": "libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-27113" }, { "url": "http://seclists.org/fulldisclosure/2025/Apr/10" }, { "url": "http://seclists.org/fulldisclosure/2025/Apr/11" }, { "url": "http://seclists.org/fulldisclosure/2025/Apr/12" }, { "url": "http://seclists.org/fulldisclosure/2025/Apr/13" }, { "url": "http://seclists.org/fulldisclosure/2025/Apr/4" }, { "url": "http://seclists.org/fulldisclosure/2025/Apr/5" }, { "url": "http://seclists.org/fulldisclosure/2025/Apr/8" }, { "url": "http://seclists.org/fulldisclosure/2025/Apr/9" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-27113" }, { "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/861" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27113" }, { "url": "https://security.netapp.com/advisory/ntap-20250306-0004/" }, { "url": "https://ubuntu.com/security/notices/USN-7302-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-27113" }, { "url": "https://www.openwall.com/lists/oss-security/2025/02/18/2" } ], "published": "2025-02-18T23:15:10+00:00", "updated": "2026-06-17T09:03:03+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.4?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.9.13-14.el9_8.4", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.4?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2025-28164", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 401, 120 ], "description": "Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via png_create_read_struct() function.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-28164" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-28164" }, { "url": "https://gist.github.com/kittener/506516f8c22178005b4379c8b2a7de20" }, { "url": "https://github.com/pnggroup/libpng/issues/655" }, { "url": "https://github.com/pnggroup/libpng/pull/657" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-28164" }, { "url": "https://ubuntu.com/security/notices/USN-7993-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-28164" } ], "published": "2026-01-27T16:16:14+00:00", "updated": "2026-06-17T09:04:37+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libpng@1.6.37-15.el9_8.2?arch=x86_64&distro=redhat-9.8&epoch=2", "versions": [ { "version": "2:1.6.37-15.el9_8.2", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libpng@1.6.37-15.el9_8.2?arch=x86_64&distro=redhat-9.8&epoch=2" } ] }, { "id": "CVE-2025-3360", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "cbl-mariner" }, "severity": "low" }, { "source": { "name": "photon" }, "severity": "low" }, { "source": { "name": "redhat" }, "score": 3.7, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 190 ], "description": "A flaw was found in GLib. An integer overflow and buffer under-read occur when parsing a long invalid ISO 8601 timestamp with the g_date_time_new_from_iso8601() function.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-3360" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-3360" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2357754" }, { "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3647" }, { "url": "https://gitlab.gnome.org/GNOME/glib/-/work_items/3647" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/04/msg00024.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3360" }, { "url": "https://ubuntu.com/security/notices/USN-7942-1" }, { "url": "https://ubuntu.com/security/notices/USN-7942-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-3360" } ], "published": "2025-04-07T13:15:43+00:00", "updated": "2026-06-30T15:16:50+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glib2@2.68.4-19.el9_8.10?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.68.4-19.el9_8.10", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/glib2@2.68.4-19.el9_8.10?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2025-4516", "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 5.1, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "rocky" }, "severity": "high" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 416 ], "description": "There is an issue in CPython when using `bytes.decode(\"unicode_escape\", error=\"ignore|replace\")`. If you are not using the \"unicode_escape\" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except catching the DecodeError.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-4516" }, { "url": "http://www.openwall.com/lists/oss-security/2025/05/16/4" }, { "url": "http://www.openwall.com/lists/oss-security/2025/05/19/1" }, { "url": "https://access.redhat.com/errata/RHSA-2025:23530" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-4516" }, { "url": "https://bugzilla.redhat.com/2294682" }, { "url": "https://bugzilla.redhat.com/2321440" }, { "url": "https://bugzilla.redhat.com/2325776" }, { "url": "https://bugzilla.redhat.com/2343237" }, { "url": "https://bugzilla.redhat.com/2366509" }, { "url": "https://bugzilla.redhat.com/2370010" }, { "url": "https://bugzilla.redhat.com/2370014" }, { "url": "https://bugzilla.redhat.com/2370016" }, { "url": "https://bugzilla.redhat.com/2372426" }, { "url": "https://bugzilla.redhat.com/2373234" }, { "url": "https://bugzilla.redhat.com/2402342" }, { "url": "https://bugzilla.redhat.com/2408891" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2294682" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2321440" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2325776" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2343237" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2366509" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370010" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370014" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370016" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2372426" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373234" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2402342" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2408891" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-11168" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5642" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-9287" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-0938" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4138" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4330" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4435" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4516" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4517" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6069" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6075" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8291" }, { "url": "https://errata.almalinux.org/8/ALSA-2025-23530.html" }, { "url": "https://errata.rockylinux.org/RLSA-2025:23530" }, { "url": "https://github.com/python/cpython/commit/4398b788ffc1f954a2c552da285477d42a571292" }, { "url": "https://github.com/python/cpython/commit/5646648678295a44aa82636c6e92826651baf33a" }, { "url": "https://github.com/python/cpython/commit/6279eb8c076d89d3739a6edb393e43c7929b429d" }, { "url": "https://github.com/python/cpython/commit/69b4387f78f413e8c47572a85b3478c47eba8142" }, { "url": "https://github.com/python/cpython/commit/73b3040f592436385007918887b7e2132aa8431f" }, { "url": "https://github.com/python/cpython/commit/8d35fd1b34935221aff23a1ab69a429dd156be77" }, { "url": "https://github.com/python/cpython/commit/9f69a58623bd01349a18ba0c7a9cb1dad6a51e8e" }, { "url": "https://github.com/python/cpython/commit/9f69a58623bd01349a18ba0c7a9cb1dad6a51e8e%20%28main%29" }, { "url": "https://github.com/python/cpython/commit/ab9893c40609935e0d40a6d2a7307ea51aec598b" }, { "url": "https://github.com/python/cpython/issues/133767" }, { "url": "https://github.com/python/cpython/pull/129648" }, { "url": "https://linux.oracle.com/cve/CVE-2025-4516.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2025-23530.html" }, { "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/L75IPBBTSCYEF56I2M4KIW353BB3AY74/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4516" }, { "url": "https://ubuntu.com/security/notices/USN-7570-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-4516" } ], "published": "2025-05-15T14:15:31+00:00", "updated": "2026-07-31T14:16:44+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2025-50181", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "ghsa" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "source": { "name": "nvd" }, "score": 6.1, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 601 ], "description": "urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-50181" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-50181" }, { "url": "https://advisory.echohq.com/cve/CVE-2025-50181" }, { "url": "https://github.com/urllib3/urllib3" }, { "url": "https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857" }, { "url": "https://github.com/urllib3/urllib3/releases/tag/2.5.0" }, { "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-pq67-6m6q-mj2v" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-50181" }, { "url": "https://ubuntu.com/security/notices/USN-7599-1" }, { "url": "https://ubuntu.com/security/notices/USN-7599-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-50181" } ], "published": "2025-06-19T01:15:24+00:00", "updated": "2026-06-17T09:34:48+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python3-pip-wheel@21.3.1-2.el9_8?arch=noarch&distro=redhat-9.8", "versions": [ { "version": "21.3.1-2.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-2.el9_8?arch=noarch&distro=redhat-9.8" } ] }, { "id": "CVE-2025-50182", "ratings": [ { "source": { "name": "ghsa" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "source": { "name": "nvd" }, "score": 6.1, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "source": { "name": "redhat" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 601 ], "description": "urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodide; the runtime itself determines redirect behavior. This issue has been patched in version 2.5.0.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-50182" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-50182" }, { "url": "https://advisory.echohq.com/cve/CVE-2025-50182" }, { "url": "https://github.com/urllib3/urllib3" }, { "url": "https://github.com/urllib3/urllib3/commit/7eb4a2aafe49a279c29b6d1f0ed0f42e9736194f" }, { "url": "https://github.com/urllib3/urllib3/releases/tag/2.5.0" }, { "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-48p4-8xcf-vxj5" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-50182" }, { "url": "https://ubuntu.com/security/notices/USN-7599-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-50182" } ], "published": "2025-06-19T02:15:17+00:00", "updated": "2026-06-17T09:34:48+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python3-pip-wheel@21.3.1-2.el9_8?arch=noarch&distro=redhat-9.8", "versions": [ { "version": "21.3.1-2.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-2.el9_8?arch=noarch&distro=redhat-9.8" } ] }, { "id": "CVE-2025-5372", "ratings": [ { "source": { "name": "alma" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 8.8, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": { "name": "nvd" }, "score": 8.8, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": { "name": "oracle-oval" }, "severity": "medium" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L" }, { "source": { "name": "rocky" }, "severity": "medium" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 682 ], "description": "A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success\u2014the function may mistakenly return a success status even when key derivation fails. This results in uninitialized cryptographic key buffers being used in subsequent communication, potentially compromising SSH sessions' confidentiality, integrity, and availability.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-5372" }, { "url": "https://access.redhat.com/errata/RHSA-2025:21977" }, { "url": "https://access.redhat.com/errata/RHSA-2025:23024" }, { "url": "https://access.redhat.com/errata/RHSA-2026:20610" }, { "url": "https://access.redhat.com/errata/RHSA-2026:24349" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25911" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-5372" }, { "url": "https://bugzilla.redhat.com/2369388" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2369388" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5372" }, { "url": "https://errata.almalinux.org/8/ALSA-2025-21977.html" }, { "url": "https://errata.rockylinux.org/RLSA-2025:21977" }, { "url": "https://linux.oracle.com/cve/CVE-2025-5372.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2025-21977.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5372" }, { "url": "https://ubuntu.com/security/notices/USN-7619-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-5372" }, { "url": "https://www.libssh.org/security/advisories/CVE-2025-5372.txt" } ], "published": "2025-07-04T06:15:24+00:00", "updated": "2026-09-01T12:17:26+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libssh-config@0.10.4-19.el9_8?arch=noarch&distro=redhat-9.8", "versions": [ { "version": "0.10.4-19.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libssh@0.10.4-19.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "0.10.4-19.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libssh-config@0.10.4-19.el9_8?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libssh@0.10.4-19.el9_8?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2025-64118", "ratings": [ { "source": { "name": "redhat" }, "score": 4.7, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], "cwes": [ 362, 367 ], "description": "node-tar is a Tar for Node.js. In 7.5.1, using .t (aka .list) with { sync: true } to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read. This vulnerability is fixed in 7.5.2.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-64118" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-64118" }, { "url": "https://github.com/isaacs/node-tar" }, { "url": "https://github.com/isaacs/node-tar/commit/5330eb04bc43014f216e5c271b40d5c00d45224d" }, { "url": "https://github.com/isaacs/node-tar/commit/5e1a8e638600d3c3a2969b4de6a6ec44fa8d74c9" }, { "url": "https://github.com/isaacs/node-tar/issues/445" }, { "url": "https://github.com/isaacs/node-tar/pull/446" }, { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-29xp-372q-xqph" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64118" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-64118" } ], "published": "2025-10-30T18:15:33+00:00", "updated": "2026-10-07T22:10:00+00:00", "affects": [ { "ref": "pkg:rpm/redhat/tar@1.34-13.el9_8?arch=x86_64&distro=redhat-9.8&epoch=2", "versions": [ { "version": "2:1.34-13.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/tar@1.34-13.el9_8?arch=x86_64&distro=redhat-9.8&epoch=2" } ] }, { "id": "CVE-2025-64505", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 6.1, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 4.4, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 125 ], "description": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_do_quantize function when processing PNG files with malformed palette indices. The vulnerability occurs when palette_lookup array bounds are not validated against externally-supplied image data, allowing an attacker to craft a PNG file with out-of-range palette indices that trigger out-of-bounds memory access. This issue has been patched in version 1.6.51.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-64505" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-64505" }, { "url": "https://github.com/pnggroup/libpng/commit/6a528eb5fd0dd7f6de1c39d30de0e41473431c37" }, { "url": "https://github.com/pnggroup/libpng/commit/6a528eb5fd0dd7f6de1c39d30de0e41473431c37%20%28v1.6.51%29" }, { "url": "https://github.com/pnggroup/libpng/pull/748" }, { "url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-4952-h5wq-4m42" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64505" }, { "url": "https://ubuntu.com/security/notices/USN-7924-1" }, { "url": "https://ubuntu.com/security/notices/USN-8081-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-64505" }, { "url": "https://www.openwall.com/lists/oss-security/2025/11/22/1" } ], "published": "2025-11-25T00:15:47+00:00", "updated": "2026-06-17T09:54:28+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libpng@1.6.37-15.el9_8.2?arch=x86_64&distro=redhat-9.8&epoch=2", "versions": [ { "version": "2:1.6.37-15.el9_8.2", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libpng@1.6.37-15.el9_8.2?arch=x86_64&distro=redhat-9.8&epoch=2" } ] }, { "id": "CVE-2025-64506", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 6.1, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 6.1, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 125 ], "description": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_write_image_8bit function when processing 8-bit images through the simplified write API with convert_to_8bit enabled. The vulnerability affects 8-bit grayscale+alpha, RGB/RGBA, and images with incomplete row data. A conditional guard incorrectly allows 8-bit input to enter code expecting 16-bit input, causing reads up to 2 bytes beyond allocated buffer boundaries. This issue has been patched in version 1.6.51.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-64506" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-64506" }, { "url": "https://github.com/pnggroup/libpng/commit/2bd84c019c300b78e811743fbcddb67c9d9bf821" }, { "url": "https://github.com/pnggroup/libpng/commit/2bd84c019c300b78e811743fbcddb67c9d9bf821%20%28v1.6.51%29" }, { "url": "https://github.com/pnggroup/libpng/pull/749" }, { "url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-qpr4-xm66-hww6" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64506" }, { "url": "https://ubuntu.com/security/notices/USN-7924-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-64506" }, { "url": "https://www.openwall.com/lists/oss-security/2025/11/22/1" } ], "published": "2025-11-25T00:15:47+00:00", "updated": "2026-06-17T09:54:28+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libpng@1.6.37-15.el9_8.2?arch=x86_64&distro=redhat-9.8&epoch=2", "versions": [ { "version": "2:1.6.37-15.el9_8.2", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libpng@1.6.37-15.el9_8.2?arch=x86_64&distro=redhat-9.8&epoch=2" } ] }, { "id": "CVE-2025-66382", "ratings": [ { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "julia" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "nvd" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 2.9, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 407 ], "description": "In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-66382" }, { "url": "http://www.openwall.com/lists/oss-security/2025/12/02/1" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-66382" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html" }, { "url": "https://github.com/libexpat/libexpat/issues/1076" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66382" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-66382" } ], "published": "2025-11-28T07:15:57+00:00", "updated": "2026-06-17T09:56:45+00:00", "affects": [ { "ref": "pkg:rpm/redhat/expat@2.5.0-6.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.5.0-6.el9_8.3", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/expat@2.5.0-6.el9_8.3?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2025-7039", "ratings": [ { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "cbl-mariner" }, "severity": "low" }, { "source": { "name": "redhat" }, "score": 3.7, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 22 ], "description": "A flaw was found in glib. An integer overflow during temporary file creation leads to an out-of-bounds memory access, allowing an attacker to potentially perform path traversal or access private temporary file content by creating symbolic links. This vulnerability allows a local attacker to manipulate file paths and access unauthorized data. The core issue stems from insufficient validation of file path lengths during temporary file operations.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-7039" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-7039" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2392423" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html" }, { "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3716" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7039" }, { "url": "https://ubuntu.com/security/notices/USN-7942-1" }, { "url": "https://ubuntu.com/security/notices/USN-7942-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-7039" } ], "published": "2025-09-03T02:15:38+00:00", "updated": "2026-06-17T10:04:08+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glib2@2.68.4-19.el9_8.10?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.68.4-19.el9_8.10", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/glib2@2.68.4-19.el9_8.10?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2025-70873", "ratings": [ { "source": { "name": "azure" }, "severity": "high" }, { "source": { "name": "bitnami" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 3.3, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" } ], "cwes": [ 244 ], "description": "An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-70873" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-70873" }, { "url": "https://gist.github.com/cnwangjihe/f496393f30f5ecec5b18c8f5ab072054" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-70873" }, { "url": "https://sqlite.org/forum/forumpost/761eac3c82" }, { "url": "https://sqlite.org/src/info/3d459f1fb1bd1b5e" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-70873" } ], "published": "2026-03-12T19:16:15+00:00", "updated": "2026-06-17T10:03:26+00:00", "affects": [ { "ref": "pkg:rpm/redhat/sqlite-libs@3.34.1-11.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.34.1-11.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/sqlite-libs@3.34.1-11.el9_8?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2025-9232", "ratings": [ { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 3.1, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 125 ], "description": "Issue summary: An application using the OpenSSL HTTP client API functions may\ntrigger an out-of-bounds read if the 'no_proxy' environment variable is set and\nthe host portion of the authority component of the HTTP URL is an IPv6 address.\n\nImpact summary: An out-of-bounds read can trigger a crash which leads to\nDenial of Service for an application.\n\nThe OpenSSL HTTP client API functions can be used directly by applications\nbut they are also used by the OCSP client functions and CMP (Certificate\nManagement Protocol) client implementation in OpenSSL. However the URLs used\nby these implementations are unlikely to be controlled by an attacker.\n\nIn this vulnerable code the out of bounds read can only trigger a crash.\nFurthermore the vulnerability requires an attacker-controlled URL to be\npassed from an application to the OpenSSL function and the user has to have\na 'no_proxy' environment variable set. For the aforementioned reasons the\nissue was assessed as Low severity.\n\nThe vulnerable code was introduced in the following patch releases:\n3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue, as the HTTP client implementation is outside the OpenSSL FIPS module\nboundary.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-9232" }, { "url": "http://www.openwall.com/lists/oss-security/2025/09/30/5" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-9232" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-089022.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-485750.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-585531.html" }, { "url": "https://github.com/advisories/GHSA-76r2-c3cg-f5r9" }, { "url": "https://github.com/openssl/openssl/commit/2b4ec20e47959170422922eaff25346d362dcb35" }, { "url": "https://github.com/openssl/openssl/commit/654dc11d23468a74fc8ea4672b702dd3feb7be4b" }, { "url": "https://github.com/openssl/openssl/commit/7cf21a30513c9e43c4bc3836c237cf086e194af3" }, { "url": "https://github.com/openssl/openssl/commit/89e790ac431125a4849992858490bed6b225eadf" }, { "url": "https://github.com/openssl/openssl/commit/bbf38c034cdabd0a13330abcc4855c866f53d2e0" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9232" }, { "url": "https://openssl-library.org/news/secadv/20250930.txt" }, { "url": "https://ubuntu.com/security/notices/USN-7786-1" }, { "url": "https://ubuntu.com/security/notices/USN-7894-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-9232" } ], "published": "2025-09-30T14:15:41+00:00", "updated": "2026-07-14T13:18:07+00:00", "affects": [ { "ref": "pkg:rpm/redhat/openssl-libs@3.5.8-1.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1", "versions": [ { "version": "1:3.5.8-1.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/openssl-libs@3.5.8-1.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1" } ] }, { "id": "CVE-2025-9403", "ratings": [ { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "nvd" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 3.3, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" } ], "cwes": [ 617 ], "description": "A vulnerability was determined in jqlang jq up to 1.6. Impacted is the function run_jq_tests of the file jq_test.c of the component JSON Parser. Executing manipulation can lead to reachable assertion. The attack requires local access. The exploit has been publicly disclosed and may be utilized. Other versions might be affected as well.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-9403" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-9403" }, { "url": "https://drive.google.com/file/d/1r8m9PhU_rk-QPj6OMcs415FcvWPD-zJY/view?usp=sharing" }, { "url": "https://github.com/jqlang/jq/issues/3393" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9403" }, { "url": "https://vuldb.com/?ctiid.321239" }, { "url": "https://vuldb.com/?id.321239" }, { "url": "https://vuldb.com/?submit.633170" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-9403" } ], "published": "2025-08-25T03:15:37+00:00", "updated": "2026-06-17T10:08:53+00:00", "affects": [ { "ref": "pkg:rpm/redhat/jq@1.6-19.el9_8.2?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "1.6-19.el9_8.2", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/jq@1.6-19.el9_8.2?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-0672", "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 4.8, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N" }, { "source": { "name": "rocky" }, "severity": "high" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 93 ], "description": "When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-0672" }, { "url": "https://access.redhat.com/errata/RHSA-2026:19177" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-0672" }, { "url": "https://bugzilla.redhat.com/2395108" }, { "url": "https://bugzilla.redhat.com/2408891" }, { "url": "https://bugzilla.redhat.com/2418084" }, { "url": "https://bugzilla.redhat.com/2431366" }, { "url": "https://bugzilla.redhat.com/2431374" }, { "url": "https://bugzilla.redhat.com/2444691" }, { "url": "https://bugzilla.redhat.com/2448168" }, { "url": "https://bugzilla.redhat.com/2448181" }, { "url": "https://bugzilla.redhat.com/2449649" }, { "url": "https://bugzilla.redhat.com/2457409" }, { "url": "https://bugzilla.redhat.com/2457932" }, { "url": "https://bugzilla.redhat.com/2458049" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2395108" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2408891" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418084" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431366" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431374" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444691" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448168" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448181" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449649" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457409" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457932" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458049" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13837" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15282" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59375" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6075" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0672" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1502" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2297" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3644" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4224" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4519" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4786" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6100" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-19177.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:19177" }, { "url": "https://github.com/python/cpython/commit/62700107418eb2cca3fc88da036a243ea975f172" }, { "url": "https://github.com/python/cpython/commit/712452e6f1d4b9f7f8c4c92ebfcaac1705faa440" }, { "url": "https://github.com/python/cpython/commit/7852d72b653fea0199acf5fc2a84f6f8b84eba8d" }, { "url": "https://github.com/python/cpython/commit/918387e4912d12ffc166c8f2a38df92b6ec756ca" }, { "url": "https://github.com/python/cpython/commit/95746b3a13a985787ef53b977129041971ed7f70" }, { "url": "https://github.com/python/cpython/commit/b1869ff648bbee0717221d09e6deff46617f3e85" }, { "url": "https://github.com/python/cpython/issues/143919" }, { "url": "https://github.com/python/cpython/pull/143920" }, { "url": "https://linux.oracle.com/cve/CVE-2026-0672.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-19177.html" }, { "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/6VFLQQEIX673KXKFUZXCUNE5AZOGZ45M/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0672" }, { "url": "https://ubuntu.com/security/notices/USN-8018-1" }, { "url": "https://ubuntu.com/security/notices/USN-8018-3" }, { "url": "https://ubuntu.com/security/notices/USN-8509-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-0672" } ], "published": "2026-01-20T22:15:52+00:00", "updated": "2026-06-17T10:11:11+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-0864", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "nvd" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" }, { "source": { "name": "redhat" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" } ], "cwes": [ 74 ], "description": "When using the \"configparser\" module to write configuration files\ncontaining multi-line text values with carriage return characters (\\r) the\nresulting file could be injected with unexpected keys and values if the\nattacker controls the written value.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-0864" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-0864" }, { "url": "https://github.com/python/cpython/commit/0adb386f6e68eb2e73d32e19f235d012df009528" }, { "url": "https://github.com/python/cpython/commit/12dcbd74d3563016a8cb8c47e4898889f34f74dd" }, { "url": "https://github.com/python/cpython/commit/274de100bbf4345bd0c23ef5b446722e9e636908" }, { "url": "https://github.com/python/cpython/commit/5858e42c539dac8394636a6e9b30472b8994851f" }, { "url": "https://github.com/python/cpython/commit/71f2e02a52d47417a6fd69f456346cd8aa7aca98" }, { "url": "https://github.com/python/cpython/commit/aaf850fd333cd89e9aada03d92aaa788a6cb1bb8" }, { "url": "https://github.com/python/cpython/commit/db4a157c790479710a1a840d7937c5c815a6f8b6" }, { "url": "https://github.com/python/cpython/issues/143927" }, { "url": "https://github.com/python/cpython/pull/151559" }, { "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/CV4NE6AFCRJL7XQOHX7J5TSDHUWVWGJS/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0864" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-0864" } ], "published": "2026-06-23T18:17:41+00:00", "updated": "2026-08-18T17:52:03+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-0988", "ratings": [ { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "cbl-mariner" }, "severity": "low" }, { "source": { "name": "redhat" }, "score": 3.7, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 190 ], "description": "A flaw was found in glib. Missing validation of offset and count parameters in the g_buffered_input_stream_peek() function can lead to an integer overflow during length calculation. When specially crafted values are provided, this overflow results in an incorrect size being passed to memcpy(), triggering a buffer overflow. This can cause application crashes, leading to a Denial of Service (DoS).", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-0988" }, { "url": "https://access.redhat.com/errata/RHSA-2026:7461" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-0988" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2429886" }, { "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3851" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0988" }, { "url": "https://ubuntu.com/security/notices/USN-7971-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-0988" } ], "published": "2026-01-21T12:15:55+00:00", "updated": "2026-06-17T10:11:43+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glib2@2.68.4-19.el9_8.10?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.68.4-19.el9_8.10", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/glib2@2.68.4-19.el9_8.10?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-0989", "ratings": [ { "source": { "name": "amazon" }, "severity": "low" }, { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "julia" }, "score": 3.7, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "photon" }, "severity": "low" }, { "source": { "name": "redhat" }, "score": 3.7, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 674 ], "description": "A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may lead to stack exhaustion and application crashes, creating a denial-of-service risk.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-0989" }, { "url": "https://access.redhat.com/errata/RHSA-2026:7519" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-0989" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2429933" }, { "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/998" }, { "url": "https://gitlab.gnome.org/GNOME/libxml2/-/merge_requests/374" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0989" }, { "url": "https://ubuntu.com/security/notices/USN-7974-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-0989" } ], "published": "2026-01-15T15:15:52+00:00", "updated": "2026-09-01T13:18:07+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.4?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.9.13-14.el9_8.4", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.4?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-0990", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 674 ], "description": "A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that references itself. A remote attacker could exploit this configuration-dependent issue by providing a specially crafted XML catalog, leading to infinite recursion and call stack exhaustion. This ultimately results in a segmentation fault, causing a Denial of Service (DoS) by crashing affected applications.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-0990" }, { "url": "https://access.redhat.com/errata/RHSA-2026:7519" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-0990" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2429959" }, { "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/1018" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0990" }, { "url": "https://ubuntu.com/security/notices/USN-7974-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-0990" } ], "published": "2026-01-15T15:15:52+00:00", "updated": "2026-09-01T12:17:34+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.4?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.9.13-14.el9_8.4", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.4?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-0992", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "cbl-mariner" }, "severity": "low" }, { "source": { "name": "julia" }, "score": 2.9, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "photon" }, "severity": "low" }, { "source": { "name": "redhat" }, "score": 2.9, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 400 ], "description": "A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-0992" }, { "url": "https://access.redhat.com/errata/RHSA-2026:7519" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-0992" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2429975" }, { "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/1019" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0992" }, { "url": "https://ubuntu.com/security/notices/USN-7974-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-0992" } ], "published": "2026-01-15T15:15:52+00:00", "updated": "2026-09-01T13:18:07+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.4?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.9.13-14.el9_8.4", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.4?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-102010", "ratings": [ { "source": { "name": "redhat" }, "score": 7, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H" } ], "cwes": [ 825 ], "description": "A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-102010" }, { "url": "https://access.redhat.com/errata/RHSA-2026:73642" }, { "url": "https://access.redhat.com/errata/RHSA-2026:74569" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-102010" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2478395" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102010" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-102010" } ], "published": "2026-09-28T19:16:48+00:00", "updated": "2026-10-02T03:16:38+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libgcc@11.5.0-14.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "11.5.0-14.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libstdc%2B%2B@11.5.0-14.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "11.5.0-14.el9", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libgcc@11.5.0-14.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libstdc%2B%2B@11.5.0-14.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/libgcc@11.5.0-14.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/libgcc@11.5.0-14.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-102633", "ratings": [ { "source": { "name": "redhat" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 190 ], "description": "libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial of service.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-102633" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-102633" }, { "url": "https://github.com/libexpat/libexpat" }, { "url": "https://github.com/libexpat/libexpat/blob/R_2_8_5/expat/lib/xmlparse.c#L1003" }, { "url": "https://github.com/libexpat/libexpat/commit/209801d7fbaf07ab74bae8cb32dd2ab9e5846118" }, { "url": "https://github.com/libexpat/libexpat/pull/1392" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102633" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-102633" }, { "url": "https://www.vulncheck.com/advisories/libexpat-2.7.2-through-2.8.5-integer-overflow-in-expat-realloc" } ], "published": "2026-09-29T17:17:06+00:00", "updated": "2026-09-29T21:32:59+00:00", "affects": [ { "ref": "pkg:rpm/redhat/expat@2.5.0-6.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.5.0-6.el9_8.3", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/expat@2.5.0-6.el9_8.3?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-103111", "ratings": [ { "source": { "name": "redhat" }, "score": 7.6, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L" } ], "cwes": [ 787 ], "description": "PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-103111" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-103111" }, { "url": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m" }, { "url": "https://lists.debian.org/debian-lts-announce/2026/10/msg00008.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103111" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-103111" } ], "published": "2026-09-30T05:16:45+00:00", "updated": "2026-10-04T00:16:35+00:00", "affects": [ { "ref": "pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8", "versions": [ { "version": "10.40-6.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "10.40-6.el9", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-107161", "ratings": [ { "source": { "name": "redhat" }, "score": 7.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "cwes": [ 122 ], "description": "A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-107161" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-107161" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460420" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107161" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-107161" } ], "published": "2026-10-07T20:17:10+00:00", "updated": "2026-10-09T02:17:02+00:00", "affects": [ { "ref": "pkg:rpm/redhat/cyrus-sasl-lib@2.1.27-22.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.1.27-22.el9", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/cyrus-sasl-lib@2.1.27-22.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-107708", "ratings": [ { "source": { "name": "redhat" }, "score": 4.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 476 ], "description": "MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-107708" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-107708" }, { "url": "https://github.com/krb5/krb5" }, { "url": "https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676" }, { "url": "https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d" }, { "url": "https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7" }, { "url": "https://github.com/krb5/krb5/pull/1510" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107708" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-107708" }, { "url": "https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac" } ], "published": "2026-10-08T21:17:52+00:00", "updated": "2026-10-08T21:33:42+00:00", "affects": [ { "ref": "pkg:rpm/redhat/krb5-libs@1.21.1-10.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "1.21.1-10.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/krb5-libs@1.21.1-10.el9_8?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-107778", "ratings": [ { "source": { "name": "redhat" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 476 ], "description": "MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-107778" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-107778" }, { "url": "https://github.com/krb5/krb5" }, { "url": "https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112" }, { "url": "https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08" }, { "url": "https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a" }, { "url": "https://github.com/krb5/krb5/pull/1511" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107778" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-107778" }, { "url": "https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred" } ], "published": "2026-10-08T21:17:52+00:00", "updated": "2026-10-08T21:33:42+00:00", "affects": [ { "ref": "pkg:rpm/redhat/krb5-libs@1.21.1-10.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "1.21.1-10.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/krb5-libs@1.21.1-10.el9_8?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-11850", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 191 ], "description": "An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read.\nThe attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-11850" }, { "url": "https://access.redhat.com/errata/RHSA-2026:25520" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-11850" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2459970" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11850" }, { "url": "https://ubuntu.com/security/notices/USN-8585-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-11850" } ], "published": "2026-06-11T10:16:21+00:00", "updated": "2026-08-31T18:17:12+00:00", "affects": [ { "ref": "pkg:rpm/redhat/krb5-libs@1.21.1-10.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "1.21.1-10.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/krb5-libs@1.21.1-10.el9_8?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-11856", "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 9.8, "severity": "critical", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "photon" }, "severity": "critical" }, { "source": { "name": "redhat" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" }, { "source": { "name": "rocky" }, "severity": "high" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 294 ], "description": "Successfully using libcurl to do a transfer to a specific HTTP origin\n(`hostA`) with **Digest** authentication and then changing the origin to a\ndifferent one (`hostB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Authorization:` header field meant for `hostA`,\nto `hostB`.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-11856" }, { "url": "https://access.redhat.com/errata/RHSA-2026:69125" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-11856" }, { "url": "https://bugzilla.redhat.com/2496759" }, { "url": "https://bugzilla.redhat.com/2496760" }, { "url": "https://bugzilla.redhat.com/2496764" }, { "url": "https://bugzilla.redhat.com/2496765" }, { "url": "https://bugzilla.redhat.com/2496767" }, { "url": "https://bugzilla.redhat.com/2496771" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496759" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496760" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496764" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496765" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496767" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496771" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://curl.se/L7HzKXisfJ/CVE-2026-11856.md" }, { "url": "https://curl.se/docs/CVE-2026-11856.html" }, { "url": "https://curl.se/docs/CVE-2026-11856.json" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11856" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8458" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8924" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8926" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8932" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9079" }, { "url": "https://errata.almalinux.org/10/ALSA-2026-69125.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:69125" }, { "url": "https://github.com/advisories/GHSA-9crq-qh8v-6xmm" }, { "url": "https://hackerone.com/reports/3793260" }, { "url": "https://linux.oracle.com/cve/CVE-2026-11856.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-69125.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11856" }, { "url": "https://ubuntu.com/security/notices/USN-8651-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-11856" } ], "published": "2026-07-03T07:16:23+00:00", "updated": "2026-09-15T07:16:25+00:00", "affects": [ { "ref": "pkg:rpm/redhat/curl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "7.76.1-40.el9_8.7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libcurl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "7.76.1-40.el9_8.7", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/curl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libcurl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-11972", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "high" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "cwes": [ 252, 606, 770 ], "description": "When using the \"tarfile\" module with a file opened in \"streaming mode\" (mode=\"r|\") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-11972" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-11972" }, { "url": "https://github.com/python/cpython/commit/3f031d431f80668e14f3bc066bbf4369cd9281b9" }, { "url": "https://github.com/python/cpython/commit/4ce6bf7c8aa7725828a38981c306f214c1f29365" }, { "url": "https://github.com/python/cpython/commit/7f0dc59c9a70f8f3b4da33d7c4a2ba552a7acc21" }, { "url": "https://github.com/python/cpython/commit/e86666c9dd256d52d0fbef6feb1ea4a51768fdec" }, { "url": "https://github.com/python/cpython/commit/eb63c0f94dfcbea7fda8eab6213818e134d67192" }, { "url": "https://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896" }, { "url": "https://github.com/python/cpython/commit/f5e2776ff0383a902c12acf2b703e7e951fc8438" }, { "url": "https://github.com/python/cpython/issues/151981" }, { "url": "https://github.com/python/cpython/pull/151982" }, { "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/AXPSKKTSRKXTTJULW3XSIC74WZNAAPPB/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11972" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-11972" } ], "published": "2026-06-23T23:16:49+00:00", "updated": "2026-08-13T01:16:51+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-12345", "ratings": [ { "source": { "name": "redhat" }, "score": 6.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H" } ], "cwes": [ 59 ], "description": "The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoids_symlink_attacks is false, remain affected, and file flags may still be reset outside of the tree on all platforms.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-12345" }, { "url": "http://www.openwall.com/lists/oss-security/2026/09/29/40" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-12345" }, { "url": "https://github.com/python/cpython/commit/06ef3d43fdaf4da97af12fa694b4886092c4b970" }, { "url": "https://github.com/python/cpython/commit/458e7134a5af7f86aee9d21b51cf499b41aa4420" }, { "url": "https://github.com/python/cpython/commit/5c20517a4fc56683efe63a7751020db9573f538d" }, { "url": "https://github.com/python/cpython/commit/e1f3590f155c6d66007e958c98c9d69316551993" }, { "url": "https://github.com/python/cpython/issues/157579" }, { "url": "https://github.com/python/cpython/pull/157580" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12345" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-12345" } ], "published": "2026-09-29T18:17:14+00:00", "updated": "2026-10-03T01:17:23+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-13346", "ratings": [ { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "nvd" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L" } ], "cwes": [ 36 ], "description": "pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels.\n\n\n\n\nThis vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running `pip download` with the `--only-binary` option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-13346" }, { "url": "http://www.openwall.com/lists/oss-security/2026/07/29/7" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-13346" }, { "url": "https://advisory.echohq.com/cve/CVE-2026-13346" }, { "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pip/PYSEC-2026-3721.yaml" }, { "url": "https://github.com/pypa/pip" }, { "url": "https://github.com/pypa/pip/commit/10dfb6b9005484578b386f64b9f36982e3dc6679" }, { "url": "https://github.com/pypa/pip/pull/14110" }, { "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/L2BNQGGVQCEV7DROOORQ7WFKKFF2OOQX" }, { "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/L2BNQGGVQCEV7DROOORQ7WFKKFF2OOQX/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13346" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-13346" } ], "published": "2026-07-29T19:16:44+00:00", "updated": "2026-08-20T13:17:44+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python3-pip-wheel@21.3.1-2.el9_8?arch=noarch&distro=redhat-9.8", "versions": [ { "version": "21.3.1-2.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-2.el9_8?arch=noarch&distro=redhat-9.8" } ] }, { "id": "CVE-2026-13595", "ratings": [ { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H" }, { "source": { "name": "nvd" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 6.8, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 416 ], "description": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-13595" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26573" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-13595" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494101" }, { "url": "https://github.com/util-linux/util-linux/commit/c0186f14fbdb02f64c8e0ba701ce727ea764ff4c" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13595" }, { "url": "https://ubuntu.com/security/notices/USN-8702-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-13595" } ], "published": "2026-06-29T09:16:28+00:00", "updated": "2026-08-31T18:17:13+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libblkid@2.37.4-25.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.37.4-25.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libmount@2.37.4-25.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.37.4-25.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libuuid@2.37.4-25.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.37.4-25.el9", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libblkid@2.37.4-25.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libmount@2.37.4-25.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libuuid@2.37.4-25.el9?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-1484", "ratings": [ { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "bottlerocket" }, "severity": "medium" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 4.2, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 787 ], "description": "A flaw was found in the GLib Base64 encoding routine when processing very large input data. Due to incorrect use of integer types during length calculation, the library may miscalculate buffer boundaries. This can cause memory writes outside the allocated buffer. Applications that process untrusted or extremely large Base64 input using GLib may crash or behave unpredictably.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-1484" }, { "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1484" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-1484" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433259" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html" }, { "url": "https://github.com/bottlerocket-os/bottlerocket-core-kit/blob/develop/advisories/14.5.0/BRSA-quby27cpefwz.toml" }, { "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3870" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1484" }, { "url": "https://ubuntu.com/security/notices/USN-8017-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-1484" } ], "published": "2026-01-27T14:15:56+00:00", "updated": "2026-06-17T10:15:52+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glib2@2.68.4-19.el9_8.10?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.68.4-19.el9_8.10", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/glib2@2.68.4-19.el9_8.10?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-1485", "ratings": [ { "source": { "name": "bottlerocket" }, "severity": "low" }, { "source": { "name": "photon" }, "severity": "low" }, { "source": { "name": "redhat" }, "score": 2.8, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 124 ], "description": "A flaw was found in Glib's content type parsing logic. This buffer underflow vulnerability occurs because the length of a header line is stored in a signed integer, which can lead to integer wraparound for very large inputs. This results in pointer underflow and out-of-bounds memory access. Exploitation requires a local user to install or process a specially crafted treemagic file, which can lead to local denial of service or application instability.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-1485" }, { "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1485" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-1485" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433325" }, { "url": "https://github.com/bottlerocket-os/bottlerocket-core-kit/blob/develop/advisories/14.5.0/BRSA-hui7k8rsmbsl.toml" }, { "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3871" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1485" }, { "url": "https://ubuntu.com/security/notices/USN-8017-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-1485" } ], "published": "2026-01-27T14:15:56+00:00", "updated": "2026-06-17T10:15:52+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glib2@2.68.4-19.el9_8.10?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.68.4-19.el9_8.10", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/glib2@2.68.4-19.el9_8.10?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-1489", "ratings": [ { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "bottlerocket" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.4, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 787 ], "description": "A flaw was found in GLib. An integer overflow vulnerability in its Unicode case conversion implementation can lead to memory corruption. By processing specially crafted and extremely large Unicode strings, an attacker could trigger an undersized memory allocation, resulting in out-of-bounds writes. This could cause applications utilizing GLib for string conversion to crash or become unstable.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-1489" }, { "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1489" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-1489" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433348" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html" }, { "url": "https://github.com/bottlerocket-os/bottlerocket-core-kit/blob/develop/advisories/14.5.0/BRSA-h6zf92f0298p.toml" }, { "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3872" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1489" }, { "url": "https://ubuntu.com/security/notices/USN-8017-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-1489" } ], "published": "2026-01-27T15:15:57+00:00", "updated": "2026-06-17T10:15:53+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glib2@2.68.4-19.el9_8.10?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.68.4-19.el9_8.10", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/glib2@2.68.4-19.el9_8.10?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-1502", "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 4.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N" }, { "source": { "name": "rocky" }, "severity": "high" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 93 ], "description": "CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-1502" }, { "url": "http://www.openwall.com/lists/oss-security/2026/04/11/4" }, { "url": "https://access.redhat.com/errata/RHSA-2026:19177" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-1502" }, { "url": "https://bugzilla.redhat.com/2395108" }, { "url": "https://bugzilla.redhat.com/2408891" }, { "url": "https://bugzilla.redhat.com/2418084" }, { "url": "https://bugzilla.redhat.com/2431366" }, { "url": "https://bugzilla.redhat.com/2431374" }, { "url": "https://bugzilla.redhat.com/2444691" }, { "url": "https://bugzilla.redhat.com/2448168" }, { "url": "https://bugzilla.redhat.com/2448181" }, { "url": "https://bugzilla.redhat.com/2449649" }, { "url": "https://bugzilla.redhat.com/2457409" }, { "url": "https://bugzilla.redhat.com/2457932" }, { "url": "https://bugzilla.redhat.com/2458049" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2395108" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2408891" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418084" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431366" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431374" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444691" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448168" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448181" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449649" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457409" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457932" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458049" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13837" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15282" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59375" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6075" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0672" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1502" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2297" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3644" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4224" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4519" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4786" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6100" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-19177.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:19177" }, { "url": "https://github.com/python/cpython/commit/05ed7ce7ae9e17c23a04085b2539fe6d6d3cef69" }, { "url": "https://github.com/python/cpython/commit/56b7100b04e44ea27989242b176beb8f016b2c53" }, { "url": "https://github.com/python/cpython/commit/58703ec1bdd1eb075e8b01a0c427683ce594dd3e" }, { "url": "https://github.com/python/cpython/commit/9e071c9b28c17f347f81b388a003d4eeb3c7a8dd" }, { "url": "https://github.com/python/cpython/commit/b1cf9016335cb637c5a425032e8274a224f4b2ed" }, { "url": "https://github.com/python/cpython/commit/c00c386faa579ad71196d33408644478488e43ec" }, { "url": "https://github.com/python/cpython/issues/146211" }, { "url": "https://github.com/python/cpython/pull/146212" }, { "url": "https://linux.oracle.com/cve/CVE-2026-1502.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-19177.html" }, { "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/2IVPAEQWUJBCTQZEJEVTYCIKSMQPGRZ3/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1502" }, { "url": "https://ubuntu.com/security/notices/USN-8509-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-1502" } ], "published": "2026-04-10T18:16:40+00:00", "updated": "2026-08-13T01:16:52+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-15146", "ratings": [ { "source": { "name": "redhat" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "description": "GNU Wget does not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. A malicious FTP server, or an HTTP server that redirects to an FTP URL, can exploit this behavior to redirect Wget\u2019s data connection to an arbitrary IP address and port. This allows an attacker to forge server-side requests (SSRF) from the machine running Wget, potentially accessing localhost services or internal network resources.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-15146" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-15146" }, { "url": "https://cgit.git.savannah.gnu.org/cgit/wget.git/commit/?id=4f85853f641863d5915786a8413e1a213726a62b" }, { "url": "https://kb.cert.org/vuls/id/564823" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15146" }, { "url": "https://ubuntu.com/security/notices/USN-8572-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-15146" }, { "url": "https://www.kb.cert.org/vuls/id/564823" } ], "published": "2026-07-10T19:17:20+00:00", "updated": "2026-07-15T19:16:57+00:00", "affects": [ { "ref": "pkg:rpm/redhat/wget@1.21.1-11.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "1.21.1-11.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/wget@1.21.1-11.el9_8?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-16599", "ratings": [ { "source": { "name": "redhat" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "cwes": [ 606 ], "description": "GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network attacker positioned to intercept FTP traffic can send a crafted OPIE challenge with a sequence number near INT_MAX, causing wget to perform up to approximately 2.1 billion MD5 computations and suspend for some time. The --timeout option does not mitigate this because it applies only to network I/O, not CPU computation.\n\n\nThis issue was fixed in commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-16599" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-16599" }, { "url": "https://cert.pl/en/posts/2026/08/CVE-2026-16599" }, { "url": "https://gitlab.com/gnuwget/wget" }, { "url": "https://gitlab.com/gnuwget/wget/-/commit/e9697d98e7249b0f68a6be040a4f3dcc5bc101fa" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16599" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-16599" } ], "published": "2026-08-25T15:16:30+00:00", "updated": "2026-08-28T15:26:19+00:00", "affects": [ { "ref": "pkg:rpm/redhat/wget@1.21.1-11.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "1.21.1-11.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/wget@1.21.1-11.el9_8?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-1757", "ratings": [ { "source": { "name": "amazon" }, "severity": "low" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 6.2, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 401 ], "description": "A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocated for user input is not properly released under certain conditions. When a user submits input consisting only of whitespace, the program skips command execution but fails to free the allocated buffer. Repeating this action causes memory to continuously accumulate. Over time, this can exhaust system memory and terminate the xmllint process, creating a denial-of-service condition on the local system.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-1757" }, { "url": "https://access.redhat.com/errata/RHSA-2026:7519" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-1757" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2435940" }, { "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/1009" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1757" }, { "url": "https://ubuntu.com/security/notices/USN-8460-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-1757" } ], "published": "2026-02-02T13:15:58+00:00", "updated": "2026-09-01T12:17:36+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.4?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.9.13-14.el9_8.4", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.4?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-18374", "ratings": [ { "source": { "name": "redhat" }, "score": 4.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 787 ], "description": "Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled.\n\n\n\nThis usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation.", "recommendation": "Upgrade glibc to version 2.34-283.el9_8; Upgrade glibc-common to version 2.34-283.el9_8; Upgrade glibc-minimal-langpack to version 2.34-283.el9_8", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-18374" }, { "url": "http://www.openwall.com/lists/oss-security/2026/08/27/6" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-18374" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18374" }, { "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34574" }, { "url": "https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2026-0015" }, { "url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0015" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-18374" } ], "published": "2026-08-27T20:17:03+00:00", "updated": "2026-09-03T16:43:15+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-18503", "ratings": [ { "source": { "name": "amazon" }, "severity": "low" }, { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "redhat" }, "score": 2.8, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L" } ], "cwes": [ 1176 ], "description": "Attacker-controlled CSV samples can trigger super-linear \nregular-expression work during dialect sniffing and consume significant \nCPU when applications pass unbounded input to csv.Sniffer.sniff().", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-18503" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-18503" }, { "url": "https://github.com/python/cpython/commit/063d4555c94ef412c731527dbf30193327f2ee82" }, { "url": "https://github.com/python/cpython/commit/476fb09cdb0d73e645849d98c610e7e5697ce7c9" }, { "url": "https://github.com/python/cpython/commit/89f29c760c02774b099ddd6863268eb13fa3946a" }, { "url": "https://github.com/python/cpython/commit/b09a67a20c464f8288c9f9a6b9c7082a74560024" }, { "url": "https://github.com/python/cpython/commit/b30c7fa9edd921a118f286e9f90f560777fa693b" }, { "url": "https://github.com/python/cpython/commit/fd78b565d7c326f96ae903ab945b47f35d829cf4" }, { "url": "https://github.com/python/cpython/issues/98820" }, { "url": "https://github.com/python/cpython/pull/153694" }, { "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/KQ7NBMCPAZJHRROQXJQE4GMXGLD5KHBS/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18503" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-18503" } ], "published": "2026-08-10T14:17:21+00:00", "updated": "2026-08-18T15:04:46+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-18924", "ratings": [ { "source": { "name": "photon" }, "severity": "critical" }, { "source": { "name": "redhat" }, "score": 3.7, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 416 ], "description": "A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent\nhandle is set to share connections with other handles, can lead to\nuse-after-free in the cleanup process.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-18924" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-18924" }, { "url": "https://curl.se/docs/CVE-2026-18924.html" }, { "url": "https://curl.se/docs/CVE-2026-18924.json" }, { "url": "https://github.com/curl/curl/commit/90325ff0444cbdff368bda5d26d6" }, { "url": "https://hackerone.com/reports/3916059" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18924" }, { "url": "https://ubuntu.com/security/notices/USN-8820-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-18924" } ], "published": "2026-09-06T18:17:20+00:00", "updated": "2026-09-15T07:16:27+00:00", "affects": [ { "ref": "pkg:rpm/redhat/curl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "7.76.1-40.el9_8.7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libcurl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "7.76.1-40.el9_8.7", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/curl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libcurl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-19445", "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "critical" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 8.1, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": { "name": "rocky" }, "severity": "high" } ], "cwes": [ 416 ], "description": "A remote, unauthenticated TLS client can make a server crash or call\nthrough a freed pointer if its sni_callback assigns a different context to\nSSLSocket.context (the documented way to select a certificate per server\nname) and nothing else keeps the original ssl.SSLContext alive. Typical\ncases are servers that create an SSLContext per connection or replace it\nwhile connections are open; servers that wrap their listening socket with\nit are not affected.\n\n\nMitigation: keep a reference to every SSLContext that sets sni_callback for\nthe lifetime of the server. TLS clients are not affected.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-19445" }, { "url": "http://www.openwall.com/lists/oss-security/2026/09/30/17" }, { "url": "https://access.redhat.com/errata/RHSA-2026:77028" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-19445" }, { "url": "https://bugzilla.redhat.com/2544127" }, { "url": "https://bugzilla.redhat.com/2544138" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544127" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544138" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19445" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19553" }, { "url": "https://errata.almalinux.org/8/ALSA-2026-77028.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:77028" }, { "url": "https://github.com/python/cpython/commit/34a53dce8174da2fceb12fe084a4def02a10053d" }, { "url": "https://github.com/python/cpython/commit/46133cd57d309652139ada74014aca7665ac552b" }, { "url": "https://github.com/python/cpython/commit/63fab143d94cafae71850831acfb52041ba44af7" }, { "url": "https://github.com/python/cpython/commit/b12968cefe69ca1dcb8606c832ff73ee7dbf4ba8" }, { "url": "https://github.com/python/cpython/commit/cd7e51e7d4563866fbaa1e2521ae69b45daf3698" }, { "url": "https://github.com/python/cpython/commit/d8717ed01717a9641686e6e6f83f0ab8af235e2c" }, { "url": "https://github.com/python/cpython/commit/ec44b5a3258cbda947d5e07242ee562ed05ef24b" }, { "url": "https://github.com/python/cpython/issues/156293" }, { "url": "https://github.com/python/cpython/pull/158504" }, { "url": "https://linux.oracle.com/cve/CVE-2026-19445.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-77028.html" }, { "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/QMQIUQB6WGGC3MI7I3WKQXOYOBDSPPS3/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19445" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-19445" } ], "published": "2026-09-30T17:16:45+00:00", "updated": "2026-10-03T01:17:24+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-19542", "ratings": [ { "source": { "name": "redhat" }, "score": 4.2, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 121 ], "description": "Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application.\n\nThe tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as needed while descending the tree. Two rebalancing branches push an additional entry without checking the capacity, and write past the array when the stack is exactly full. Triggering this requires a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree with at least a million nodes, so an attacker must drive a large number of insertions and deletions through an application that uses tsearch and tdelete. The written value is a pointer into a tree node and is not directly attacker controlled. No affected application in common distributions has been identified.", "recommendation": "Upgrade glibc to version 2.34-283.el9_8; Upgrade glibc-common to version 2.34-283.el9_8; Upgrade glibc-minimal-langpack to version 2.34-283.el9_8", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-19542" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-19542" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19542" }, { "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34506" }, { "url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0018" }, { "url": "https://ubuntu.com/security/notices/USN-8737-1" }, { "url": "https://ubuntu.com/security/notices/USN-8737-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-19542" } ], "published": "2026-09-14T18:17:46+00:00", "updated": "2026-09-18T18:17:47+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-19553", "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "high" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 7.4, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" }, { "source": { "name": "rocky" }, "severity": "high" } ], "cwes": [ 297 ], "description": "ssl.SSLContext.wrap_bio() didn't require the server_hostname argument\nto not be None if ssl.SSLContext.check_hostname was set. Due to a\nmissing parameter check in SSLObject, if the server_hostname argument\nisn't supplied then hostname verification would be silently skipped.\n\n\nThis defect could lead to programs where certificate hostname verification\n*appeared* to be succeeding with SSLContext.check_hostname = True and no\nValueError being raised due to misconfiguration.\n\n\nIf the program passes a server_hostname value that isn't an empty string\nor None to any of these APIs then certificate hostname verification\nproceeds as expected and the program is not affected by this vulnerability.\n\n\nMitigating this vulnerability doesn't require updating Python or applying\nthe patch. To mitigate, pass a valid non-None and non-empty\nserver_hostname value to SSLContext.wrap_bio(),\nasyncio.create_connection(), or asyncio.loop.start_tls() and\ncertificate hostname verification will proceed as expected. Upgrading to\nthe latest version of Python or applying the patch only changes the\nbehavior from silently skipping hostname verification to raising a\nValueError, similar to SSLContext.wrap_socket(), when server_hostname\nisn't supplied.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-19553" }, { "url": "http://www.openwall.com/lists/oss-security/2026/09/30/16" }, { "url": "https://access.redhat.com/errata/RHSA-2026:77028" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-19553" }, { "url": "https://bugzilla.redhat.com/2544127" }, { "url": "https://bugzilla.redhat.com/2544138" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544127" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544138" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19445" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19553" }, { "url": "https://errata.almalinux.org/8/ALSA-2026-77028.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:77028" }, { "url": "https://github.com/python/cpython/commit/1697ea386c707142555d98a1263176bbbc014a96" }, { "url": "https://github.com/python/cpython/commit/5867d4e4ae6d1062352baf6b497a4026e8578ccf" }, { "url": "https://github.com/python/cpython/commit/641390146a16a38e6701923f4ee4f1940ae77082" }, { "url": "https://github.com/python/cpython/commit/869069d52ce0efab2f8c38197e92cdaaa312f1ed" }, { "url": "https://github.com/python/cpython/commit/966bf426d0b6c31c1b0a255ff14a17143a466ced" }, { "url": "https://github.com/python/cpython/commit/bdebbf9b366ec91e9cd9daa0b3510c9e84b60b80" }, { "url": "https://github.com/python/cpython/commit/f4e43ba525187282f2011da0e6ffc0d2b08d8062" }, { "url": "https://github.com/python/cpython/issues/156793" }, { "url": "https://github.com/python/cpython/pull/158503" }, { "url": "https://linux.oracle.com/cve/CVE-2026-19553.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-77028.html" }, { "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/QNZRG3YOAMTHDCMVCICXGY6YEFPY2VDL/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19553" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-19553" } ], "published": "2026-09-30T17:16:45+00:00", "updated": "2026-10-03T01:17:25+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-19672", "ratings": [ { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" } ], "cwes": [ 22 ], "description": "The tarfile module's tar and data\n extraction filters created directories outside the destination for \nmembers whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given.\n\nOnly\n empty directories are created outside the destination. Member contents \nare still extracted inside it. To return to the destination the member's\n name must contain the destination directory's own final component, so \nextraction into a secure randomised directory is not affected.\n\nThis affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-19672" }, { "url": "http://www.openwall.com/lists/oss-security/2026/08/25/10" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-19672" }, { "url": "https://github.com/python/cpython/pull/156000" }, { "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/J2WT2ALRWEXQJOB3C7Q2HYWUXP3CINWO/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19672" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-19672" } ], "published": "2026-08-19T16:17:06+00:00", "updated": "2026-08-28T21:16:15+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-19931", "ratings": [ { "source": { "name": "photon" }, "severity": "critical" }, { "source": { "name": "redhat" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" } ], "cwes": [ 488 ], "description": "A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given\nhostname using Negotiate authentication, when the initial request is done\nusing empty credentials. This can make user B's request get sent over user A's\npreviously authenticated connection.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-19931" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-19931" }, { "url": "https://curl.se/docs/CVE-2026-19931.html" }, { "url": "https://curl.se/docs/CVE-2026-19931.json" }, { "url": "https://hackerone.com/reports/3923520" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19931" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-19931" } ], "published": "2026-09-06T18:17:20+00:00", "updated": "2026-09-15T07:16:27+00:00", "affects": [ { "ref": "pkg:rpm/redhat/curl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "7.76.1-40.el9_8.7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libcurl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "7.76.1-40.el9_8.7", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/curl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libcurl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-22185", "ratings": [ { "source": { "name": "redhat" }, "score": 6.8, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 125, 191 ], "description": "OpenLDAP Lightning Memory-Mapped Database (LMDB) versions up to and including 0.9.14, prior to commit 8e1fda8, contain a heap buffer underflow in the readline() function of mdb_load. When processing malformed input containing an embedded NUL byte, an unsigned offset calculation can underflow and cause an out-of-bounds read of one byte before the allocated heap buffer. This can cause mdb_load to crash, leading to a limited denial-of-service condition.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-22185" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-22185" }, { "url": "https://bugs.openldap.org/show_bug.cgi?id=10421" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22185" }, { "url": "https://seclists.org/fulldisclosure/2026/Jan/5" }, { "url": "https://seclists.org/fulldisclosure/2026/Jan/8" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-22185" }, { "url": "https://www.openldap.org/" }, { "url": "https://www.vulncheck.com/advisories/openldap-lmdb-mdb-load-heap-buffer-underflow-in-readline" } ], "published": "2026-01-07T21:16:01+00:00", "updated": "2026-06-17T10:19:30+00:00", "affects": [ { "ref": "pkg:rpm/redhat/openldap@2.6.8-4.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.6.8-4.el9", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/openldap@2.6.8-4.el9?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-22693", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 476 ], "description": "HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hb_malloc returns NULL before using placement new to construct an object at the returned pointer address. When hb_malloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault. This issue has been patched in version 12.3.0.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-22693" }, { "url": "http://www.openwall.com/lists/oss-security/2026/01/11/1" }, { "url": "http://www.openwall.com/lists/oss-security/2026/01/12/1" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-22693" }, { "url": "https://github.com/harfbuzz/harfbuzz/commit/1265ff8d990284f04d8768f35b0e20ae5f60daae" }, { "url": "https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-xvjr-f2r9-c7ww" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22693" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-22693" } ], "published": "2026-01-10T06:15:52+00:00", "updated": "2026-06-17T10:20:14+00:00", "affects": [ { "ref": "pkg:rpm/redhat/harfbuzz@2.7.4-10.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.7.4-10.el9", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/harfbuzz@2.7.4-10.el9?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-2297", "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 3.3, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" }, { "source": { "name": "rocky" }, "severity": "high" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 668 ], "description": "The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers for this audit event therefore do not fire.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-2297" }, { "url": "http://www.openwall.com/lists/oss-security/2026/03/05/6" }, { "url": "https://access.redhat.com/errata/RHSA-2026:19177" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-2297" }, { "url": "https://bugzilla.redhat.com/2395108" }, { "url": "https://bugzilla.redhat.com/2408891" }, { "url": "https://bugzilla.redhat.com/2418084" }, { "url": "https://bugzilla.redhat.com/2431366" }, { "url": "https://bugzilla.redhat.com/2431374" }, { "url": "https://bugzilla.redhat.com/2444691" }, { "url": "https://bugzilla.redhat.com/2448168" }, { "url": "https://bugzilla.redhat.com/2448181" }, { "url": "https://bugzilla.redhat.com/2449649" }, { "url": "https://bugzilla.redhat.com/2457409" }, { "url": "https://bugzilla.redhat.com/2457932" }, { "url": "https://bugzilla.redhat.com/2458049" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2395108" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2408891" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418084" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431366" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431374" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444691" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448168" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448181" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449649" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457409" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457932" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458049" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13837" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15282" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59375" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6075" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0672" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1502" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2297" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3644" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4224" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4519" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4786" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6100" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-19177.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:19177" }, { "url": "https://github.com/python/cpython/commit/482d6f8bdba9da3725d272e8bb4a2d25fb6a603e" }, { "url": "https://github.com/python/cpython/commit/69ddd9bb2cc4bd69b1565647c18659c6a789ccd9" }, { "url": "https://github.com/python/cpython/commit/876858c9f65d9ab656c7fa639f268ce7856d89dd" }, { "url": "https://github.com/python/cpython/commit/a51b1b512de1d56b3714b65628a2eae2b07e535e" }, { "url": "https://github.com/python/cpython/commit/c70adad78caeeea33f92f560ecb93331ca11bf66" }, { "url": "https://github.com/python/cpython/commit/e58e9802b9bec5cdbf48fc9bf1da5f4fda482e86" }, { "url": "https://github.com/python/cpython/issues/145506" }, { "url": "https://github.com/python/cpython/pull/145507" }, { "url": "https://linux.oracle.com/cve/CVE-2026-2297.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-19177.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2297" }, { "url": "https://ubuntu.com/security/notices/USN-8509-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-2297" } ], "published": "2026-03-04T23:16:10+00:00", "updated": "2026-08-13T01:16:52+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-23865", "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "bitnami" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L" }, { "source": { "name": "rocky" }, "severity": "high" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 125 ], "description": "An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in versions 2.13.2 and 2.13.3 may allow for an out of bounds read operation when parsing HVAR/VVAR/MVAR tables in OpenType variable fonts. This issue is fixed in version 2.14.2.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-23865" }, { "url": "http://www.openwall.com/lists/oss-security/2026/03/03/8" }, { "url": "https://access.redhat.com/errata/RHSA-2026:9689" }, { "url": "https://access.redhat.com/errata/RHSA-2026:9693" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-23865" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2443891" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460038" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460039" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460040" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460041" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460042" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460043" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460044" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22007" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22013" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22016" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22018" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22021" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23865" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34268" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34282" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-9693.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:9689" }, { "url": "https://github.com/advisories/GHSA-878v-mxg6-vj8f" }, { "url": "https://gitlab.com/freetype/freetype/-/commit/fc85a255849229c024c8e65f536fe1875d84841c" }, { "url": "https://linux.oracle.com/cve/CVE-2026-23865.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-9693.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23865" }, { "url": "https://sourceforge.net/projects/freetype/files/freetype2/2.14.2" }, { "url": "https://sourceforge.net/projects/freetype/files/freetype2/2.14.2/" }, { "url": "https://ubuntu.com/security/notices/USN-8086-1" }, { "url": "https://ubuntu.com/security/notices/USN-8327-1" }, { "url": "https://ubuntu.com/security/notices/USN-8328-1" }, { "url": "https://ubuntu.com/security/notices/USN-8330-1" }, { "url": "https://ubuntu.com/security/notices/USN-8331-1" }, { "url": "https://ubuntu.com/security/notices/USN-8332-1" }, { "url": "https://ubuntu.com/security/notices/USN-8333-1" }, { "url": "https://ubuntu.com/security/notices/USN-8334-1" }, { "url": "https://ubuntu.com/security/notices/USN-8339-1" }, { "url": "https://ubuntu.com/security/notices/USN-8341-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-23865" }, { "url": "https://www.facebook.com/security/advisories/cve-2026-23865" }, { "url": "https://www.oracle.com/security-alerts/cpuapr2026.html#AppendixJAVA" } ], "published": "2026-03-02T17:16:32+00:00", "updated": "2026-06-17T10:22:13+00:00", "affects": [ { "ref": "pkg:rpm/redhat/freetype@2.10.4-10.el9_5?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.10.4-10.el9_5", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/freetype@2.10.4-10.el9_5?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-24515", "ratings": [ { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "cbl-mariner" }, "severity": "low" }, { "source": { "name": "julia" }, "score": 2.5, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "nvd" }, "score": 2.5, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "photon" }, "severity": "low" }, { "source": { "name": "redhat" }, "score": 2.9, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 476 ], "description": "In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-24515" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-24515" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html" }, { "url": "https://github.com/libexpat/libexpat/pull/1131" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24515" }, { "url": "https://ubuntu.com/security/notices/USN-8022-1" }, { "url": "https://ubuntu.com/security/notices/USN-8022-2" }, { "url": "https://ubuntu.com/security/notices/USN-8023-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-24515" } ], "published": "2026-01-23T08:16:01+00:00", "updated": "2026-06-17T10:23:10+00:00", "affects": [ { "ref": "pkg:rpm/redhat/expat@2.5.0-6.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.5.0-6.el9_8.3", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/expat@2.5.0-6.el9_8.3?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-25068", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 4.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 129 ], "description": "alsa-lib versions 1.2.2 up to and including 1.2.15.2, prior to commit 5f7fe33, contain a heap-based buffer overflow in the topology mixer control decoder. The tplg_decode_control_mixer1() function reads the num_channels field from untrusted .tplg data and uses it as a loop bound without validating it against the fixed-size channel array (SND_TPLG_MAX_CHAN). A crafted topology file with an excessive num_channels value can cause out-of-bounds heap writes, leading to a crash.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-25068" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-25068" }, { "url": "https://github.com/alsa-project/alsa-lib/commit/5f7fe33002d2d98d84f72e381ec2cccc0d5d3d40" }, { "url": "https://lists.debian.org/debian-lts-announce/2026/02/msg00008.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25068" }, { "url": "https://ubuntu.com/security/notices/USN-8044-1" }, { "url": "https://ubuntu.com/security/notices/USN-8044-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-25068" }, { "url": "https://www.vulncheck.com/advisories/alsa-lib-topology-decoder-heap-based-buffer-overflow" } ], "published": "2026-01-29T20:16:10+00:00", "updated": "2026-06-17T10:24:04+00:00", "affects": [ { "ref": "pkg:rpm/redhat/alsa-lib@1.2.15.3-1.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "1.2.15.3-1.el9", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/alsa-lib@1.2.15.3-1.el9?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-25645", "ratings": [ { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "ghsa" }, "score": 4.4, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N" }, { "source": { "name": "nvd" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 4.7, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 377 ], "description": "Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-25645" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-25645" }, { "url": "https://github.com/psf/requests" }, { "url": "https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7" }, { "url": "https://github.com/psf/requests/releases/tag/v2.33.0" }, { "url": "https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25645" }, { "url": "https://ubuntu.com/security/notices/USN-8825-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-25645" } ], "published": "2026-03-25T17:16:52+00:00", "updated": "2026-06-17T10:25:00+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python3-pip-wheel@21.3.1-2.el9_8?arch=noarch&distro=redhat-9.8", "versions": [ { "version": "21.3.1-2.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-2.el9_8?arch=noarch&distro=redhat-9.8" } ] }, { "id": "CVE-2026-27171", "ratings": [ { "source": { "name": "amazon" }, "severity": "low" }, { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "cbl-mariner" }, "severity": "low" }, { "source": { "name": "julia" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "nvd" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 3.3, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 1284 ], "description": "zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-27171" }, { "url": "https://7asecurity.com/blog/2026/02/zlib-7asecurity-audit" }, { "url": "https://7asecurity.com/blog/2026/02/zlib-7asecurity-audit/" }, { "url": "https://7asecurity.com/reports/pentest-report-zlib-RC1.1.pdf" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-27171" }, { "url": "https://github.com/advisories/GHSA-h858-mf2m-8jf4" }, { "url": "https://github.com/madler/zlib/issues/904" }, { "url": "https://github.com/madler/zlib/releases/tag/v1.3.2" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27171" }, { "url": "https://ostif.org/zlib-audit-complete" }, { "url": "https://ostif.org/zlib-audit-complete/" }, { "url": "https://ubuntu.com/security/notices/USN-8706-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-27171" } ], "published": "2026-02-18T04:16:01+00:00", "updated": "2026-06-17T10:26:47+00:00", "affects": [ { "ref": "pkg:rpm/redhat/zlib@1.2.11-40.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "1.2.11-40.el9", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/zlib@1.2.11-40.el9?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-27456", "ratings": [ { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "bottlerocket" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 4.7, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 4.7, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 59, 269, 367 ], "description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-27456" }, { "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-27456" }, { "url": "https://github.com/bottlerocket-os/bottlerocket-core-kit/blob/develop/advisories/14.5.0/BRSA-jgcxwcxt3sxd.toml" }, { "url": "https://github.com/util-linux/util-linux/commit/5e390467b26a3cf3fecc04e1a0d482dff3162fc4" }, { "url": "https://github.com/util-linux/util-linux/releases/tag/v2.41.4" }, { "url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-qq4x-vfq4-9h9g" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27456" }, { "url": "https://ubuntu.com/security/notices/USN-8702-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-27456" } ], "published": "2026-04-03T22:16:25+00:00", "updated": "2026-07-24T22:10:00+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libblkid@2.37.4-25.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.37.4-25.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libmount@2.37.4-25.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.37.4-25.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libuuid@2.37.4-25.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.37.4-25.el9", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libblkid@2.37.4-25.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libmount@2.37.4-25.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libuuid@2.37.4-25.el9?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-28387", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "julia" }, "score": 8.1, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": { "name": "nvd" }, "score": 8.1, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 3.7, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 416 ], "description": "Issue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-28387" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-28387" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" }, { "url": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b" }, { "url": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe" }, { "url": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3" }, { "url": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7" }, { "url": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28387" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://ubuntu.com/security/notices/USN-8155-1" }, { "url": "https://ubuntu.com/security/notices/USN-8155-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-28387" }, { "url": "https://www.openwall.com/lists/oss-security/2026/04/07/11" } ], "published": "2026-04-07T22:16:20+00:00", "updated": "2026-07-24T23:10:00+00:00", "affects": [ { "ref": "pkg:rpm/redhat/openssl-libs@3.5.8-1.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1", "versions": [ { "version": "1:3.5.8-1.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/openssl-libs@3.5.8-1.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1" } ] }, { "id": "CVE-2026-28388", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "nvd" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 5.9, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 476 ], "description": "Issue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-28388" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-28388" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" }, { "url": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e" }, { "url": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139" }, { "url": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3" }, { "url": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8" }, { "url": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28388" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://ubuntu.com/security/notices/USN-8155-1" }, { "url": "https://ubuntu.com/security/notices/USN-8155-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-28388" }, { "url": "https://www.openwall.com/lists/oss-security/2026/04/07/11" } ], "published": "2026-04-07T22:16:20+00:00", "updated": "2026-07-24T23:10:00+00:00", "affects": [ { "ref": "pkg:rpm/redhat/openssl-libs@3.5.8-1.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1", "versions": [ { "version": "1:3.5.8-1.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/openssl-libs@3.5.8-1.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1" } ] }, { "id": "CVE-2026-28389", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "nvd" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 5.9, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 476 ], "description": "Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-28389" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-28389" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" }, { "url": "https://github.com/advisories/GHSA-7x88-9hgc-69gf" }, { "url": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5" }, { "url": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616" }, { "url": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f" }, { "url": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a" }, { "url": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28389" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://ubuntu.com/security/notices/USN-8155-1" }, { "url": "https://ubuntu.com/security/notices/USN-8155-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-28389" }, { "url": "https://www.openwall.com/lists/oss-security/2026/04/07/11" } ], "published": "2026-04-07T22:16:21+00:00", "updated": "2026-07-24T23:10:00+00:00", "affects": [ { "ref": "pkg:rpm/redhat/openssl-libs@3.5.8-1.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1", "versions": [ { "version": "1:3.5.8-1.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/openssl-libs@3.5.8-1.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1" } ] }, { "id": "CVE-2026-31789", "ratings": [ { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 9.8, "severity": "critical", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": { "name": "nvd" }, "score": 9.8, "severity": "critical", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": { "name": "photon" }, "severity": "critical" }, { "source": { "name": "redhat" }, "score": 5.8, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 787 ], "description": "Issue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-31789" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "url": "https://github.com/advisories/GHSA-j79m-9jxq-788r" }, { "url": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde" }, { "url": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf" }, { "url": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49" }, { "url": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9" }, { "url": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31789" }, { "url": "https://openssl-library.org/news/secadv/20260407.txt" }, { "url": "https://ubuntu.com/security/notices/USN-8155-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-31789" }, { "url": "https://www.openwall.com/lists/oss-security/2026/04/07/11" } ], "published": "2026-04-07T22:16:21+00:00", "updated": "2026-07-24T23:10:00+00:00", "affects": [ { "ref": "pkg:rpm/redhat/openssl-libs@3.5.8-1.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1", "versions": [ { "version": "1:3.5.8-1.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/openssl-libs@3.5.8-1.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1" } ] }, { "id": "CVE-2026-32284", "ratings": [ { "source": { "name": "ghsa" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 125 ], "description": "The msgpack decoder fails to properly validate the input buffer length when processing truncated fixext data (format codes 0xd4-0xd8). This can lead to an out-of-bounds read and a runtime panic, allowing a denial of service attack.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-32284" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-32284" }, { "url": "https://github.com/golang/vulndb/issues/4513" }, { "url": "https://github.com/shamaton/msgpack" }, { "url": "https://github.com/shamaton/msgpack/issues/59" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32284" }, { "url": "https://pkg.go.dev/vuln/GO-2026-4513" }, { "url": "https://securityinfinity.com/research/shamaton-msgpack-oob-panic-fixext-dos-2026" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-32284" } ], "published": "2026-03-26T20:16:12+00:00", "updated": "2026-10-07T18:17:20+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python3-pip-wheel@21.3.1-2.el9_8?arch=noarch&distro=redhat-9.8", "versions": [ { "version": "21.3.1-2.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-2.el9_8?arch=noarch&distro=redhat-9.8" } ] }, { "id": "CVE-2026-32316", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "high" }, { "source": { "name": "nvd" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 6.8, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 122, 190 ], "description": "jq is a command-line JSON processor. An integer overflow vulnerability exists through version 1.8.1 within the jvp_string_append() and jvp_string_copy_replace_bad functions, where concatenating strings with a combined length exceeding 2^31 bytes causes a 32-bit unsigned integer overflow in the buffer allocation size calculation, resulting in a drastically undersized heap buffer. Subsequent memory copy operations then write the full string data into this undersized buffer, causing a heap buffer overflow classified as CWE-190 (Integer Overflow) leading to CWE-122 (Heap-based Buffer Overflow). Any system evaluating untrusted jq queries is affected, as an attacker can crash the process or potentially achieve further exploitation through heap corruption by crafting queries that produce extremely large strings. The root cause is the absence of string size bounds checking, unlike arrays and objects which already have size limits. The issue has been addressed in commit e47e56d226519635768e6aab2f38f0ab037c09e5.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-32316" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-32316" }, { "url": "https://github.com/jqlang/jq/commit/e47e56d226519635768e6aab2f38f0ab037c09e5" }, { "url": "https://github.com/jqlang/jq/security/advisories/GHSA-q3h9-m34w-h76f" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32316" }, { "url": "https://ubuntu.com/security/notices/USN-8202-1" }, { "url": "https://ubuntu.com/security/notices/USN-8202-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-32316" } ], "published": "2026-04-13T18:16:29+00:00", "updated": "2026-06-17T10:35:33+00:00", "affects": [ { "ref": "pkg:rpm/redhat/jq@1.6-19.el9_8.2?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "1.6-19.el9_8.2", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/jq@1.6-19.el9_8.2?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-3276", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 407 ], "description": "unicodedata.normalize() can take excessive CPU time when processing\nspecially crafted Unicode input containing long runs of combining characters\nwith alternating Canonical Combining Class values.\nThis affects all normalization forms.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-3276" }, { "url": "http://www.openwall.com/lists/oss-security/2026/06/03/15" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-3276" }, { "url": "https://github.com/python/cpython/commit/6b505d1f41f8f3ea0fe5a4786d3a8fff1875cfc0" }, { "url": "https://github.com/python/cpython/commit/90748760d38ca3ac5fc6788a69becab905c95598" }, { "url": "https://github.com/python/cpython/commit/991224b1e8311c85f198f6dd8208bf8cff7fc26f" }, { "url": "https://github.com/python/cpython/commit/ba785b88add96acbf403d65cb157fb2743a33a32" }, { "url": "https://github.com/python/cpython/commit/c5512bd7c1dc28055660565275012766941d3066" }, { "url": "https://github.com/python/cpython/commit/d3ab945af25b28dfe13ac6cb40c124a01b33ce1f" }, { "url": "https://github.com/python/cpython/commit/db744c0776c1d5dd11aaa70eff2a6993c408bacc" }, { "url": "https://github.com/python/cpython/commit/e322a1857084d521f79f45181b776f62e6acfc2c" }, { "url": "https://github.com/python/cpython/issues/149079" }, { "url": "https://github.com/python/cpython/pull/149080" }, { "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/PP5HB4K7727OBBM76KA2ILID76K3OZGZ/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3276" }, { "url": "https://ubuntu.com/security/notices/USN-8509-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-3276" }, { "url": "https://www.openwall.com/lists/oss-security/2026/06/03/15" } ], "published": "2026-06-03T16:16:29+00:00", "updated": "2026-08-13T01:16:52+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-32776", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "nvd" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 6.2, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 476 ], "description": "libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-32776" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-32776" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" }, { "url": "https://github.com/libexpat/libexpat/pull/1158" }, { "url": "https://github.com/libexpat/libexpat/pull/1159" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32776" }, { "url": "https://ubuntu.com/security/notices/USN-8790-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-32776" } ], "published": "2026-03-16T14:19:44+00:00", "updated": "2026-07-14T13:18:49+00:00", "affects": [ { "ref": "pkg:rpm/redhat/expat@2.5.0-6.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.5.0-6.el9_8.3", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/expat@2.5.0-6.el9_8.3?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-32777", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "julia" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "nvd" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 4, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 835 ], "description": "libexpat before 2.7.5 allows an infinite loop while parsing DTD content.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-32777" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-32777" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" }, { "url": "https://github.com/libexpat/libexpat/issues/1161" }, { "url": "https://github.com/libexpat/libexpat/pull/1159" }, { "url": "https://github.com/libexpat/libexpat/pull/1162" }, { "url": "https://issues.oss-fuzz.com/issues/486993411" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32777" }, { "url": "https://ubuntu.com/security/notices/USN-8790-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-32777" } ], "published": "2026-03-16T14:19:44+00:00", "updated": "2026-07-14T13:18:49+00:00", "affects": [ { "ref": "pkg:rpm/redhat/expat@2.5.0-6.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.5.0-6.el9_8.3", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/expat@2.5.0-6.el9_8.3?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-32778", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "julia" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "nvd" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.1, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 476 ], "description": "libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-32778" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-32778" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" }, { "url": "https://github.com/libexpat/libexpat/pull/1159" }, { "url": "https://github.com/libexpat/libexpat/pull/1163" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32778" }, { "url": "https://ubuntu.com/security/notices/USN-8790-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-32778" } ], "published": "2026-03-16T14:19:44+00:00", "updated": "2026-07-14T13:18:49+00:00", "affects": [ { "ref": "pkg:rpm/redhat/expat@2.5.0-6.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.5.0-6.el9_8.3", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/expat@2.5.0-6.el9_8.3?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-33056", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "ghsa" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N" }, { "source": { "name": "nvd" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N" }, { "source": { "name": "redhat" }, "score": 4.4, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 61 ], "description": "tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory \u2014 and subsequently apply chmod to it. This allows an attacker to modify the permissions of arbitrary directories outside the extraction root. This issue has been fixed in version 0.4.45.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-33056" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-33056" }, { "url": "https://github.com/alexcrichton/tar-rs" }, { "url": "https://github.com/alexcrichton/tar-rs/commit/17b1fd84e632071cb8eef9d3709bf347bd266446" }, { "url": "https://github.com/alexcrichton/tar-rs/security/advisories/GHSA-j4xf-2g29-59ph" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33056" }, { "url": "https://rustsec.org/advisories/RUSTSEC-2026-0067.html" }, { "url": "https://ubuntu.com/security/notices/USN-8138-1" }, { "url": "https://ubuntu.com/security/notices/USN-8139-1" }, { "url": "https://ubuntu.com/security/notices/USN-8168-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-33056" } ], "published": "2026-03-20T08:16:11+00:00", "updated": "2026-06-17T10:36:52+00:00", "affects": [ { "ref": "pkg:rpm/redhat/tar@1.34-13.el9_8?arch=x86_64&distro=redhat-9.8&epoch=2", "versions": [ { "version": "2:1.34-13.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/tar@1.34-13.el9_8?arch=x86_64&distro=redhat-9.8&epoch=2" } ] }, { "id": "CVE-2026-33947", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "nvd" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 6.2, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 674 ], "description": "jq is a command-line JSON processor. In versions 1.8.1 and below, functions jv_setpath(), jv_getpath(), and delpaths_sorted() in jq's src/jv_aux.c use unbounded recursion whose depth is controlled by the length of a caller-supplied path array, with no depth limit enforced. An attacker can supply a JSON document containing a flat array of ~65,000 integers (~200 KB) that, when used as a path argument by a trusted jq filter, exhausts the C call stack and crashes the process with a segmentation fault (SIGSEGV). This bypass works because the existing MAX_PARSING_DEPTH (10,000) limit only protects the JSON parser, not runtime path operations where arrays can be programmatically constructed to arbitrary lengths. The impact is denial of service (unrecoverable crash) affecting any application or service that processes untrusted JSON input through jq's setpath, getpath, or delpaths builtins. This issue has been addressed in commit fb59f1491058d58bdc3e8dd28f1773d1ac690a1f.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-33947" }, { "url": "http://www.openwall.com/lists/oss-security/2026/04/16/1" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-33947" }, { "url": "https://github.com/jqlang/jq/commit/fb59f1491058d58bdc3e8dd28f1773d1ac690a1f" }, { "url": "https://github.com/jqlang/jq/security/advisories/GHSA-xwrw-4f8h-rjvg" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33947" }, { "url": "https://ubuntu.com/security/notices/USN-8202-1" }, { "url": "https://ubuntu.com/security/notices/USN-8202-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-33947" } ], "published": "2026-04-13T22:16:29+00:00", "updated": "2026-06-17T10:38:21+00:00", "affects": [ { "ref": "pkg:rpm/redhat/jq@1.6-19.el9_8.2?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "1.6-19.el9_8.2", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/jq@1.6-19.el9_8.2?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-33948", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "nvd" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 3.8, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 20, 170 ], "description": "jq is a command-line JSON processor. Commits before 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b contain a vulnerability where CLI input parsing allows validation bypass via embedded NUL bytes. When reading JSON from files or stdin, jq uses strlen() to determine buffer length instead of the actual byte count from fgets(), causing it to truncate input at the first NUL byte and parse only the preceding prefix. This enables an attacker to craft input with a benign JSON prefix before a NUL byte followed by malicious trailing data, where jq validates only the prefix as valid JSON while silently discarding the suffix. Workflows relying on jq to validate untrusted JSON before forwarding it to downstream consumers are susceptible to parser differential attacks, as those consumers may process the full input including the malicious trailing bytes. This issue has been patched by commit 6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-33948" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-33948" }, { "url": "https://github.com/jqlang/jq/commit/6374ae0bcdfe33a18eb0ae6db28493b1f34a0a5b" }, { "url": "https://github.com/jqlang/jq/security/advisories/GHSA-32cx-cvvh-2wj9" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33948" }, { "url": "https://ubuntu.com/security/notices/USN-8202-1" }, { "url": "https://ubuntu.com/security/notices/USN-8202-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-33948" } ], "published": "2026-04-14T00:16:06+00:00", "updated": "2026-10-09T10:36:33+00:00", "affects": [ { "ref": "pkg:rpm/redhat/jq@1.6-19.el9_8.2?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "1.6-19.el9_8.2", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/jq@1.6-19.el9_8.2?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-34743", "ratings": [ { "source": { "name": "alma" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "julia" }, "score": 5.3, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "nvd" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "oracle-oval" }, "severity": "medium" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "rocky" }, "severity": "medium" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 122 ], "description": "XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-34743" }, { "url": "http://www.openwall.com/lists/oss-security/2026/03/31/13" }, { "url": "https://access.redhat.com/errata/RHSA-2026:64787" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-34743" }, { "url": "https://bugzilla.redhat.com/2454589" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454589" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34743" }, { "url": "https://errata.almalinux.org/10/ALSA-2026-64787.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:64787" }, { "url": "https://github.com/tukaani-project/xz/commit/c8c22869e780ff57c96b46939c3d79ff99395f87" }, { "url": "https://github.com/tukaani-project/xz/releases/tag/v5.8.3" }, { "url": "https://github.com/tukaani-project/xz/security/advisories/GHSA-x872-m794-cxhv" }, { "url": "https://linux.oracle.com/cve/CVE-2026-34743.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-64787-0.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2026/07/msg00034.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34743" }, { "url": "https://tukaani.org/xz/index-append-overflow.html" }, { "url": "https://ubuntu.com/security/notices/USN-8362-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-34743" } ], "published": "2026-04-02T19:21:33+00:00", "updated": "2026-07-24T21:10:00+00:00", "affects": [ { "ref": "pkg:rpm/redhat/xz-libs@5.2.5-8.el9_0?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "5.2.5-8.el9_0", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/xz-libs@5.2.5-8.el9_0?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-34757", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 4.4, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" }, { "source": { "name": "nvd" }, "score": 4.4, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 4.4, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 416 ], "description": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.0.9 to before 1.6.57, passing a pointer obtained from png_get_PLTE, png_get_tRNS, or png_get_hIST back into the corresponding setter on the same png_struct/png_info pair causes the setter to read from freed memory and copy its contents into the replacement buffer. The setter frees the internal buffer before copying from the caller-supplied pointer, which now dangles. The freed region may contain stale data (producing silently corrupted chunk metadata) or data from subsequent heap allocations (leaking unrelated heap contents into the chunk struct). This vulnerability is fixed in 1.6.57.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-34757" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-34757" }, { "url": "https://github.com/pnggroup/libpng/commit/398cbe3df03f4e11bb031e07f416dfdde3684e8a" }, { "url": "https://github.com/pnggroup/libpng/commit/55d20aaa322c9274491cda82c5cd4f99b48c6bcc" }, { "url": "https://github.com/pnggroup/libpng/issues/836" }, { "url": "https://github.com/pnggroup/libpng/issues/837" }, { "url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-6fr7-g8h7-v645" }, { "url": "https://lists.debian.org/debian-lts-announce/2026/05/msg00017.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34757" }, { "url": "https://ubuntu.com/security/notices/USN-8251-1" }, { "url": "https://ubuntu.com/security/notices/USN-8639-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-34757" } ], "published": "2026-04-09T15:16:11+00:00", "updated": "2026-06-17T10:39:34+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libpng@1.6.37-15.el9_8.2?arch=x86_64&distro=redhat-9.8&epoch=2", "versions": [ { "version": "2:1.6.37-15.el9_8.2", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libpng@1.6.37-15.el9_8.2?arch=x86_64&distro=redhat-9.8&epoch=2" } ] }, { "id": "CVE-2026-3479", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 3.3, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" } ], "cwes": [ 22 ], "description": "DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation has been updated to clarify this point. There is no vulnerability in the function if following the intended security model.\n\npkgutil.get_data() did not validate the resource argument as documented, allowing path traversals.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-3479" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-3479" }, { "url": "https://github.com/python/cpython/commit/5af6ce3e7b643a30a02d22245c1e3f4a8bc0a1fe" }, { "url": "https://github.com/python/cpython/commit/bcdf231946b1da8bdfbab4c05539bb0cc964a1c7" }, { "url": "https://github.com/python/cpython/commit/cf59bf76470f3d75ad47d80ffb8ce76b64b5e943" }, { "url": "https://github.com/python/cpython/commit/d786d59a8f7196bb630100a869f28ad13436b59c" }, { "url": "https://github.com/python/cpython/issues/146121" }, { "url": "https://github.com/python/cpython/pull/146122" }, { "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/WYLLVQOOCKGK73JM7Z7ZSNOJC4N7BAWY/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3479" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-3479" } ], "published": "2026-03-18T19:16:06+00:00", "updated": "2026-06-17T10:43:39+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-35189", "ratings": [ { "source": { "name": "redhat" }, "score": 3.7, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 770 ], "description": "Issue summary: A certificate with many nameRelativeToCRLIssuer CRL\ndistribution points causes disproportionate heap growth when OpenSSL caches\nX.509 extensions.\n\nImpact summary: Receiving a crafted certificate from a malicious peer can lead\nto significant memory pressure and possible Denial of Service in clients or\nin servers that solicit client certificates.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: A certificate or a set of certificates that fits under the limit for\nsize of certificates accepted from the peer (~100 KiB) can result in allocation\nof several hundred MiB of resident memory on the receiving side\nduring a normal TLS handshake. This may be enough to crash the client or\nserver, if multiple concurrent connections lead to similarly large memory\nallocations.\n\nThe fix postpones processing of the CRL distribution points extensions in\ncertificates to the time when the processed value is required for CRL processing.\nThis avoids keeping large memory allocations for a long time when such\ncertificates are received.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-35189" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-35189" }, { "url": "https://github.com/openssl/openssl/commit/2b93c73b2c70ddc4c61c5e4bfaaa6bd71379eb84" }, { "url": "https://github.com/openssl/openssl/commit/3842516cc15e8b2cf55747011045e77547e71d89" }, { "url": "https://github.com/openssl/openssl/commit/8e0efc7549b7ff8246d40e585e3fd604f728473f" }, { "url": "https://github.com/openssl/openssl/commit/c72ae182cac17a82e4246c6ecd4e9c4ec3586ec9" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35189" }, { "url": "https://openssl-library.org/news/secadv/20260929.txt" }, { "url": "https://ubuntu.com/security/notices/USN-8847-1" }, { "url": "https://ubuntu.com/security/notices/USN-8847-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-35189" } ], "published": "2026-09-29T16:17:07+00:00", "updated": "2026-10-08T01:01:54+00:00", "affects": [ { "ref": "pkg:rpm/redhat/openssl-libs@3.5.8-1.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1", "versions": [ { "version": "1:3.5.8-1.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/openssl-libs@3.5.8-1.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-35191", "ratings": [ { "source": { "name": "redhat" }, "score": 3.7, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 440 ], "description": "Issue summary: The OpenSSL QUIC server, when configured to not preform address\nvalidation, can be forced to count incoming packets multiple times in its\nunvalidated credit computation, leading to a violation of the RFC 9000\nunvalidated connection amplification limit of 3 times the amount of data\nreceived.\n\nImpact summary: A remote attacker able to spoof packets to a server using the\nOpenSSL QUIC implementation might use the server for an amplification of\na DDoS attack.\n\nCWE: CWE-440: Expected Behavior Violation \n\nDescription: OpenSSL's QUIC stack, when operating as a server, enforces client\naddress validation (RFC 9000, Section 8), to confirm the peer address is not\nused for a traffic amplification attack. If this feature is disabled on the\nserver, the QUIC stack limits the amount of server data that can be sent to 3\ntimes the amount of data received from the peer address, until such time as the\nTLS handshake is completed.\n\nThe OpenSSL QUIC server, when operating in non-validation mode, adds the\nlength of the whole datagram received to the unvalidated credit limit when\nprocessing each QUIC packet in the datagram. A remote peer may,\nafter establishing a connection with an initial client hello frame, send a\nsubsequent datagram containing multiple QUIC packets, leading the server to\naccount the entire datagram length for each packet in the datagram, resulting\nin the server believing that the peer has sent more data than it actually has,\nthereby violating the 3x amplification limit mandated by the RFC.\n\nFIPS impact: no\nAs the QUIC stack lives outside the FIPS module boundary, no FIPS modules\nare affected by this CVE.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-35191" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-35191" }, { "url": "https://github.com/openssl/openssl/commit/0fe4442d4f8ea3af8a174046dae176e0d4717239" }, { "url": "https://github.com/openssl/openssl/commit/2de4c35fb13fc58f43fd8dc1d261700472ce72e5" }, { "url": "https://github.com/openssl/openssl/commit/e44292e58b090014232ef75bd400393851b24d1a" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35191" }, { "url": "https://openssl-library.org/news/secadv/20260929.txt" }, { "url": "https://ubuntu.com/security/notices/USN-8847-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-35191" } ], "published": "2026-09-29T16:17:07+00:00", "updated": "2026-10-08T01:02:06+00:00", "affects": [ { "ref": "pkg:rpm/redhat/openssl-libs@3.5.8-1.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1", "versions": [ { "version": "1:3.5.8-1.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/openssl-libs@3.5.8-1.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-3644", "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "nvd" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 5.4, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" }, { "source": { "name": "rocky" }, "severity": "high" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 20, 116 ], "description": "The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-3644" }, { "url": "https://access.redhat.com/errata/RHSA-2026:19177" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-3644" }, { "url": "https://bugzilla.redhat.com/2395108" }, { "url": "https://bugzilla.redhat.com/2408891" }, { "url": "https://bugzilla.redhat.com/2418084" }, { "url": "https://bugzilla.redhat.com/2431366" }, { "url": "https://bugzilla.redhat.com/2431374" }, { "url": "https://bugzilla.redhat.com/2444691" }, { "url": "https://bugzilla.redhat.com/2448168" }, { "url": "https://bugzilla.redhat.com/2448181" }, { "url": "https://bugzilla.redhat.com/2449649" }, { "url": "https://bugzilla.redhat.com/2457409" }, { "url": "https://bugzilla.redhat.com/2457932" }, { "url": "https://bugzilla.redhat.com/2458049" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2395108" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2408891" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418084" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431366" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431374" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444691" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448168" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448181" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449649" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457409" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457932" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458049" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13837" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15282" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59375" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6075" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0672" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1502" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2297" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3644" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4224" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4519" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4786" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6100" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-19177.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:19177" }, { "url": "https://github.com/python/cpython/commit/3974092b037f9a3b000fb15b48ea61ce3b25d330" }, { "url": "https://github.com/python/cpython/commit/556aa098e738b127c714866f819b4abe2f7593d8" }, { "url": "https://github.com/python/cpython/commit/57e88c1cf95e1481b94ae57abe1010469d47a6b4" }, { "url": "https://github.com/python/cpython/commit/62ceb396fcbe69da1ded3702de586f4072b590dd" }, { "url": "https://github.com/python/cpython/commit/d16ecc6c3626f0e2cc8f08c309c83934e8a979dd" }, { "url": "https://github.com/python/cpython/commit/dae4b1a21f8df4570e30986affd61bbe4ade4cef" }, { "url": "https://github.com/python/cpython/issues/145599" }, { "url": "https://github.com/python/cpython/pull/145600" }, { "url": "https://linux.oracle.com/cve/CVE-2026-3644.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-19177.html" }, { "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/H6CADMBCDRFGWCMOXWUIHFJNV43GABJ7/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3644" }, { "url": "https://ubuntu.com/security/notices/USN-8509-1" }, { "url": "https://ubuntu.com/security/notices/USN-8744-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-3644" } ], "published": "2026-03-16T18:16:09+00:00", "updated": "2026-08-13T01:16:53+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-3731", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 7.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "nvd" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 119, 125 ], "description": "A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected component.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-3731" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-3731" }, { "url": "https://gitlab.com/libssh/libssh-mirror/-/commit/855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3731" }, { "url": "https://ubuntu.com/security/notices/USN-8093-1" }, { "url": "https://ubuntu.com/security/notices/USN-8093-2" }, { "url": "https://vuldb.com/?ctiid.349709" }, { "url": "https://vuldb.com/?id.349709" }, { "url": "https://vuldb.com/?submit.767120" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-3731" }, { "url": "https://www.libssh.org/files/0.12/libssh-0.12.0.tar.xz" }, { "url": "https://www.libssh.org/security/advisories/libssh-2026-sftp-extensions.txt" } ], "published": "2026-03-08T11:15:50+00:00", "updated": "2026-06-17T10:44:05+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libssh-config@0.10.4-19.el9_8?arch=noarch&distro=redhat-9.8", "versions": [ { "version": "0.10.4-19.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libssh@0.10.4-19.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "0.10.4-19.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libssh-config@0.10.4-19.el9_8?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libssh@0.10.4-19.el9_8?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-3784", "ratings": [ { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 305 ], "description": "curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a\nserver, even if the new request uses different credentials for the HTTP proxy.\nThe proper behavior is to create or use a separate connection.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-3784" }, { "url": "http://www.openwall.com/lists/oss-security/2026/03/11/3" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-3784" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html" }, { "url": "https://curl.se/docs/CVE-2026-3784.html" }, { "url": "https://curl.se/docs/CVE-2026-3784.json" }, { "url": "https://github.com/advisories/GHSA-5q3w-6p3j-mw6p" }, { "url": "https://hackerone.com/reports/3584903" }, { "url": "https://linux.oracle.com/cve/CVE-2026-3784.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-55450.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3784" }, { "url": "https://ubuntu.com/security/notices/USN-8084-1" }, { "url": "https://ubuntu.com/security/notices/USN-8099-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-3784" } ], "published": "2026-03-11T11:16:00+00:00", "updated": "2026-09-15T07:16:27+00:00", "affects": [ { "ref": "pkg:rpm/redhat/curl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "7.76.1-40.el9_8.7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libcurl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "7.76.1-40.el9_8.7", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/curl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libcurl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-39956", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 6.1, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 125, 476, 843 ], "description": "jq is a command-line JSON processor. Prior to version 1.8.2, the _strindices builtin in jq's src/builtin.c passes its arguments directly to jv_string_indexes() without verifying they are strings, and jv_string_indexes() in src/jv.c relies solely on assert() checks that are stripped in release builds compiled with -DNDEBUG. This allows an attacker to crash jq trivially with input like _strindices(0), and by crafting a numeric value whose IEEE-754 bit pattern maps to a chosen pointer, achieve a controlled pointer dereference and limited memory read/probe primitive. Any deployment that evaluates untrusted jq filters against a release build is vulnerable. This issue has been patched in commit fdf8ef0f0810e3d365cdd5160de43db46f57ed03, which is part of version 1.8.2.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-39956" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-39956" }, { "url": "https://github.com/jqlang/jq/commit/fdf8ef0f0810e3d365cdd5160de43db46f57ed03" }, { "url": "https://github.com/jqlang/jq/security/advisories/GHSA-6gc3-3g9p-xx28" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39956" }, { "url": "https://ubuntu.com/security/notices/USN-8202-1" }, { "url": "https://ubuntu.com/security/notices/USN-8202-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-39956" } ], "published": "2026-04-13T23:16:27+00:00", "updated": "2026-09-04T14:17:19+00:00", "affects": [ { "ref": "pkg:rpm/redhat/jq@1.6-19.el9_8.2?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "1.6-19.el9_8.2", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/jq@1.6-19.el9_8.2?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-40467", "ratings": [ { "source": { "name": "alma" }, "severity": "medium" }, { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 7.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "nvd" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "oracle-oval" }, "severity": "medium" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 4, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "rocky" }, "severity": "medium" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 416 ], "description": "Use After Free vulnerability has been found in \"io.c\" program file of gawk (do_getline_redir() routine). This issue may lead to a crash. It affects\u00a0gawk in versions 5.4.0 and below.", "recommendation": "Upgrade gawk to version 5.1.0-6.el9_8.1", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-40467" }, { "url": "https://access.redhat.com/errata/RHSA-2026:73512" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-40467" }, { "url": "https://bugzilla.redhat.com/2499655" }, { "url": "https://bugzilla.redhat.com/2499657" }, { "url": "https://bugzilla.redhat.com/2499658" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499655" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499657" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499658" }, { "url": "https://cert.pl/en/posts/2026/07/CVE-2026-40467" }, { "url": "https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=a2d18c74109e41bec29a23098eba2e00057286d8" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40467" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40468" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40553" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-73512.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:73512" }, { "url": "https://linux.oracle.com/cve/CVE-2026-40467.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-73512.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40467" }, { "url": "https://ubuntu.com/security/notices/USN-8588-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-40467" } ], "published": "2026-07-13T13:16:36+00:00", "updated": "2026-07-14T01:13:59+00:00", "affects": [ { "ref": "pkg:rpm/redhat/gawk@5.1.0-6.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "5.1.0-6.el9", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/gawk@5.1.0-6.el9?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-40468", "ratings": [ { "source": { "name": "alma" }, "severity": "medium" }, { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "julia" }, "score": 9.1, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H" }, { "source": { "name": "nvd" }, "score": 9.1, "severity": "critical", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H" }, { "source": { "name": "oracle-oval" }, "severity": "medium" }, { "source": { "name": "photon" }, "severity": "critical" }, { "source": { "name": "redhat" }, "score": 4.4, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L" }, { "source": { "name": "rocky" }, "severity": "medium" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 190 ], "description": "Integer overflow vulnerability has been found in \"builtin.c\" program file of gawk. This issue may lead to memory exhaustion on the hosting operating system and could be used to overwrite gawk heap metadata and objects with attacker-controlled bytes. It affects\u00a0gawk in versions 5.4.0 and below.", "recommendation": "Upgrade gawk to version 5.1.0-6.el9_8.1", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-40468" }, { "url": "https://access.redhat.com/errata/RHSA-2026:73512" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-40468" }, { "url": "https://bugzilla.redhat.com/2499655" }, { "url": "https://bugzilla.redhat.com/2499657" }, { "url": "https://bugzilla.redhat.com/2499658" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499655" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499657" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499658" }, { "url": "https://cert.pl/en/posts/2026/07/CVE-2026-40467" }, { "url": "https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=062f2f2581b991362c046f7f2e238ffa34e6f8c7" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40467" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40468" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40553" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-73512.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:73512" }, { "url": "https://linux.oracle.com/cve/CVE-2026-40468.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-73512.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40468" }, { "url": "https://ubuntu.com/security/notices/USN-8588-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-40468" } ], "published": "2026-07-13T13:16:36+00:00", "updated": "2026-07-14T01:12:11+00:00", "affects": [ { "ref": "pkg:rpm/redhat/gawk@5.1.0-6.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "5.1.0-6.el9", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/gawk@5.1.0-6.el9?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-40553", "ratings": [ { "source": { "name": "alma" }, "severity": "medium" }, { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 7.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "nvd" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "oracle-oval" }, "severity": "medium" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 6.2, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "rocky" }, "severity": "medium" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 121 ], "description": "Buffer overflow vulnerability has been found in \"extension/readdir.c\" program file of gawk (ftype()\u00a0routine). This issue could be used to crash the program and potentially to achieve code execution, although the latter has not been confirmed to be feasible. It affects\u00a0gawk in versions 5.4.0 and below.", "recommendation": "Upgrade gawk to version 5.1.0-6.el9_8.1", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-40553" }, { "url": "https://access.redhat.com/errata/RHSA-2026:73512" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-40553" }, { "url": "https://bugzilla.redhat.com/2499655" }, { "url": "https://bugzilla.redhat.com/2499657" }, { "url": "https://bugzilla.redhat.com/2499658" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499655" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499657" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499658" }, { "url": "https://cert.pl/en/posts/2026/07/CVE-2026-40467" }, { "url": "https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=cca0366144336b49aaa7d5d949966ce8e2c70843" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40467" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40468" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40553" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-73512.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:73512" }, { "url": "https://linux.oracle.com/cve/CVE-2026-40553.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-73512.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40553" }, { "url": "https://ubuntu.com/security/notices/USN-8588-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-40553" } ], "published": "2026-07-13T13:16:37+00:00", "updated": "2026-07-14T01:10:20+00:00", "affects": [ { "ref": "pkg:rpm/redhat/gawk@5.1.0-6.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "5.1.0-6.el9", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/gawk@5.1.0-6.el9?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-40612", "ratings": [ { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "nvd" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "cwes": [ 674 ], "description": "jq is a command-line JSON processor. In 1.8.1 and earlier, jv_contains recurses into nested arrays/objects with no depth limit. With a sufficiently nested input structure (built programmatically with reduce, since the JSON parser caps at depth 10000), the C stack is exhausted.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-40612" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-40612" }, { "url": "https://github.com/jqlang/jq/security/advisories/GHSA-r7m6-x9c7-h69j" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40612" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-40612" } ], "published": "2026-05-11T18:16:33+00:00", "updated": "2026-06-17T10:45:32+00:00", "affects": [ { "ref": "pkg:rpm/redhat/jq@1.6-19.el9_8.2?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "1.6-19.el9_8.2", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/jq@1.6-19.el9_8.2?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-40930", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 5.4, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 436 ], "description": "LIBPNG is a reference library for use in applications that process PNG (Portable Network Graphics) raster image files. In version 1.8.0, three inter-frame chunk discard paths in the push-mode APNG parser clear the chunk-header flag without consuming the chunk body and CRC, allowing attacker-controlled bytes inside an ignored ancillary chunk to be reinterpreted as a fresh chunk header on the next call to `png_process_data`. Commit faf06924688b62d7c1654b5ceddedbde66ffadb4 fixes the issue.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-40930" }, { "url": "http://www.openwall.com/lists/oss-security/2026/05/15/21" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-40930" }, { "url": "https://github.com/pnggroup/libpng/commit/faf06924688b62d7c1654b5ceddedbde66ffadb4" }, { "url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-c4v6-gxrq-6g2x" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40930" }, { "url": "https://ubuntu.com/security/notices/USN-8639-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-40930" } ], "published": "2026-06-04T16:16:36+00:00", "updated": "2026-07-22T20:10:00+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libpng@1.6.37-15.el9_8.2?arch=x86_64&distro=redhat-9.8&epoch=2", "versions": [ { "version": "2:1.6.37-15.el9_8.2", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libpng@1.6.37-15.el9_8.2?arch=x86_64&distro=redhat-9.8&epoch=2" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-41080", "ratings": [ { "source": { "name": "amazon" }, "severity": "low" }, { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "julia" }, "score": 2.9, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 3.7, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 331 ], "description": "libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-41080" }, { "url": "http://www.openwall.com/lists/oss-security/2026/04/26/1" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-41080" }, { "url": "https://blog.hartwork.org/posts/expat-2-8-0-released/" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" }, { "url": "https://github.com/libexpat/libexpat/issues/47" }, { "url": "https://github.com/libexpat/libexpat/pull/1183" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41080" }, { "url": "https://ubuntu.com/security/notices/USN-8520-1" }, { "url": "https://ubuntu.com/security/notices/USN-8790-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-41080" }, { "url": "https://www.openwall.com/lists/oss-security/2026/04/26/1" } ], "published": "2026-04-16T17:16:54+00:00", "updated": "2026-07-14T13:18:51+00:00", "affects": [ { "ref": "pkg:rpm/redhat/expat@2.5.0-6.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.5.0-6.el9_8.3", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/expat@2.5.0-6.el9_8.3?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-41256", "ratings": [ { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 158 ], "description": "jq is a command-line JSON processor. In 1.8.1 and earlier, Top-level jq programs loaded from a file with -f are truncated at the first embedded NUL byte on current upstream HEAD. A crafted filter file such as . followed by \\x00 and arbitrary suffix compiles and executes as only the prefix before the NUL. This leaves jq with a post-CVE-2026-33948 prefix/full-buffer mismatch on the compilation path even though the JSON parser path has already been fixed.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-41256" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-41256" }, { "url": "https://github.com/jqlang/jq/commit/5a015deae35d19e3ebbc65db6c157a80e76df738" }, { "url": "https://github.com/jqlang/jq/security/advisories/GHSA-vf2h-chrj-q3fg" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41256" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-41256" } ], "published": "2026-05-11T18:16:33+00:00", "updated": "2026-06-17T10:46:23+00:00", "affects": [ { "ref": "pkg:rpm/redhat/jq@1.6-19.el9_8.2?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "1.6-19.el9_8.2", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/jq@1.6-19.el9_8.2?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-41257", "ratings": [ { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "nvd" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 190, 787 ], "description": "jq is a command-line JSON processor. In 1.8.1 and earlier, the jq bytecode VM's data stack tracks its allocation size in a signed int. When the stack grows beyond \u22481 GiB (via deeply nested generator forks), the doubling arithmetic overflows. The wrapped value is passed to realloc and then used for a memmove with attacker-influenced offsets.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-41257" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-41257" }, { "url": "https://github.com/jqlang/jq/commit/01b3cded76daacbfddb7f8763700b0803bcb5c6f" }, { "url": "https://github.com/jqlang/jq/security/advisories/GHSA-4jm8-m363-4539" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41257" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-41257" } ], "published": "2026-05-11T18:16:34+00:00", "updated": "2026-06-17T10:46:23+00:00", "affects": [ { "ref": "pkg:rpm/redhat/jq@1.6-19.el9_8.2?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "1.6-19.el9_8.2", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/jq@1.6-19.el9_8.2?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-4224", "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "bitnami" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "nvd" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "rocky" }, "severity": "high" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 674 ], "description": "When an Expat parser with a registered ElementDeclHandler parses an inline\ndocument type definition containing a deeply nested content model a C stack\noverflow occurs.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-4224" }, { "url": "http://www.openwall.com/lists/oss-security/2026/03/16/4" }, { "url": "https://access.redhat.com/errata/RHSA-2026:19177" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-4224" }, { "url": "https://bugzilla.redhat.com/2395108" }, { "url": "https://bugzilla.redhat.com/2408891" }, { "url": "https://bugzilla.redhat.com/2418084" }, { "url": "https://bugzilla.redhat.com/2431366" }, { "url": "https://bugzilla.redhat.com/2431374" }, { "url": "https://bugzilla.redhat.com/2444691" }, { "url": "https://bugzilla.redhat.com/2448168" }, { "url": "https://bugzilla.redhat.com/2448181" }, { "url": "https://bugzilla.redhat.com/2449649" }, { "url": "https://bugzilla.redhat.com/2457409" }, { "url": "https://bugzilla.redhat.com/2457932" }, { "url": "https://bugzilla.redhat.com/2458049" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2395108" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2408891" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418084" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431366" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431374" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444691" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448168" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448181" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449649" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457409" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457932" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458049" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13837" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15282" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59375" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6075" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0672" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1502" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2297" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3644" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4224" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4519" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4786" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6100" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-19177.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:19177" }, { "url": "https://github.com/python/cpython/commit/196edfb06a7458377d4d0f4b3cd41724c1f3bd4a" }, { "url": "https://github.com/python/cpython/commit/24ce88b285f56ee11626cf5e472af3cd8cc7c621" }, { "url": "https://github.com/python/cpython/commit/642865ddf4b232da1f3b1f7abcfa3254c4bfe785" }, { "url": "https://github.com/python/cpython/commit/af856a7177326ac25d9f66cc6dd28b554d914fee" }, { "url": "https://github.com/python/cpython/commit/e0a8a6da90597a924b300debe045cdb4628ee1f3" }, { "url": "https://github.com/python/cpython/commit/eb0e8be3a7e11b87d198a2c3af1ed0eccf532768" }, { "url": "https://github.com/python/cpython/issues/145986" }, { "url": "https://github.com/python/cpython/pull/145987" }, { "url": "https://linux.oracle.com/cve/CVE-2026-4224.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-19177.html" }, { "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/5M7CGUW3XBRY7II4DK43KF7NQQ3TPZ6R/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4224" }, { "url": "https://ubuntu.com/security/notices/USN-8509-1" }, { "url": "https://ubuntu.com/security/notices/USN-8744-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-4224" } ], "published": "2026-03-16T18:16:10+00:00", "updated": "2026-08-13T01:16:53+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-42250", "ratings": [ { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 787 ], "description": "bzip2 contains an off\u2011by\u2011one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out\u2011of\u2011bounds write to a global buffer, resulting in memory corruption and a crash (denial of service).\n\nThis issue was fixed in bzip2 patch\u00a035d122a3df8b0cc4082a4d89fdc6ee99f375fe67", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-42250" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-42250" }, { "url": "https://cert.pl/en/posts/2026/05/CVE-2026-42250/" }, { "url": "https://inbox.sourceware.org/bzip2-devel/20260528145407.293768-1-mark@klomp.org/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42250" }, { "url": "https://sourceware.org/bzip2/" }, { "url": "https://sourceware.org/cgit/bzip2/commit/?id=35d122a3df8b0cc4082a4d89fdc6ee99f375fe67" }, { "url": "https://ubuntu.com/security/notices/USN-8685-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-42250" } ], "published": "2026-05-28T14:16:19+00:00", "updated": "2026-06-17T10:47:34+00:00", "affects": [ { "ref": "pkg:rpm/redhat/bzip2-libs@1.0.8-11.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "1.0.8-11.el9", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/bzip2-libs@1.0.8-11.el9?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-42308", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "ghsa" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "nvd" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 6.2, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 190 ], "description": "Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-42308" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-42308" }, { "url": "https://advisory.echohq.com/cve/CVE-2026-42308" }, { "url": "https://github.com/advisories/GHSA-wjx4-4jcj-g98j" }, { "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-165.yaml" }, { "url": "https://github.com/python-pillow/Pillow" }, { "url": "https://github.com/python-pillow/Pillow/pull/9518/changes%20%28suspected%20fix%29" }, { "url": "https://github.com/python-pillow/Pillow/releases/tag/12.2.0" }, { "url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-wjx4-4jcj-g98j" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42308" }, { "url": "https://ubuntu.com/security/notices/USN-8399-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-42308" } ], "published": "2026-05-09T06:16:09+00:00", "updated": "2026-07-24T21:10:00+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-42765", "ratings": [ { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 5.9, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 476 ], "description": "Issue summary: When a partial-chain certificate verification is enabled\ntogether with OCSP response checking for the whole chain, a NULL dereference\nwill happen if the verified chain does not have a self-signed trusted anchor,\ncrashing the process.\n\nImpact summary: A NULL pointer dereference can trigger a crash which leads to a\nDenial of Service for an application.\n\nWhen performing OCSP response checking for certificates in the verification\nchain, the code always tries to access the next certificate as the issuer.\nThere is a check for a self-signed certificate. However with the partial\nchain verification enabled when the chain does not have a self-signed trusted\nanchor, the issuer will be NULL for the last certificate in the chain. A NULL\npointer dereference then happens.\n\nThis issue affects only applications which enable both OCSP verification\nof the certificate chain (X509_V_FLAG_OCSP_RESP_CHECK_ALL) and partial\nchain verification (X509_V_FLAG_PARTIAL_CHAIN) in the certificate\nverification. Both flags are disabled by default. For that reason, we have\nassigned Low severity to the issue.\n\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-42765" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-42765" }, { "url": "https://github.com/openssl/openssl/commit/14340b7fa1d444615486bc137014b064e64ec334" }, { "url": "https://github.com/openssl/openssl/commit/eb345da18ce2216b2f3ade9c2bc23e068487fa97" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42765" }, { "url": "https://openssl-library.org/news/secadv/20260609.txt" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-42765" } ], "published": "2026-06-09T17:17:07+00:00", "updated": "2026-07-23T08:10:00+00:00", "affects": [ { "ref": "pkg:rpm/redhat/openssl-libs@3.5.8-1.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1", "versions": [ { "version": "1:3.5.8-1.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/openssl-libs@3.5.8-1.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1" } ] }, { "id": "CVE-2026-42772", "ratings": [ { "source": { "name": "redhat" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 407 ], "description": "Issue summary: The QUIC stream reassembly algorithm performance deteriorates\nprogressively as packets are arriving out of order. The worst case has\na quadratic complexity proportional to the number of stream frames kept in\nthe buffer for the received stream data.\n\nImpact summary: A remote QUIC peer that completes the handshake can create\na connection-scoped CPU pressure and potentially a Denial of Service using\ncompliant STREAM frames inside the advertised receive window, with low\nattacker bandwidth.\n\nCWE: CWE-407: Inefficient Algorithmic Complexity\n\nDescription: OpenSSL manages received QUIC stream fragments using a\ndoubly-linked list. While it optimizes for append operations (at the end of\nthe list), it falls back to a head-to-tail linear search for any fragment\nthat does not immediately follow the current `tail`.\n\nBy manipulating the sequence of offsets, an attacker can force the server\nto perform O(n^2) operations, consuming excessive CPU time for the\nQUIC process.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-42772" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-42772" }, { "url": "https://github.com/openssl/openssl/commit/32d0ed8afe1b8c3e7ece725b44663da3d7087a09" }, { "url": "https://github.com/openssl/openssl/commit/ca8402e273af4de5b3f04fa61a0f0c02ce3ae20e" }, { "url": "https://github.com/openssl/openssl/commit/eb2becc0a4baea7f3050a247834d0e5c2ebe1773" }, { "url": "https://github.com/openssl/openssl/commit/f42ae513bbda513b3c121d54834040ee4a0eae1a" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42772" }, { "url": "https://openssl-library.org/news/secadv/20260929.txt" }, { "url": "https://ubuntu.com/security/notices/USN-8861-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-42772" } ], "published": "2026-09-29T16:17:07+00:00", "updated": "2026-10-08T01:18:57+00:00", "affects": [ { "ref": "pkg:rpm/redhat/openssl-libs@3.5.8-1.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1", "versions": [ { "version": "1:3.5.8-1.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/openssl-libs@3.5.8-1.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-4360", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "bitnami" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "source": { "name": "nvd" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "source": { "name": "redhat" }, "score": 5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 281 ], "description": "In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter='data' to the extract() function.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-4360" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-4360" }, { "url": "https://github.com/python/cpython/commit/0367912be336348b30572f8029cec4a282782d92" }, { "url": "https://github.com/python/cpython/commit/5e0ef3f1afe892e4f64eb83368db57ac4c40cba0" }, { "url": "https://github.com/python/cpython/commit/7b57e8d51446297b8c7c482d224bc5f1938e4301" }, { "url": "https://github.com/python/cpython/commit/7ccdbaba2c54250a70d7f25632152df7655a5e0a" }, { "url": "https://github.com/python/cpython/commit/cf23b9153181062150d061468b6d24af33fe214f" }, { "url": "https://github.com/python/cpython/commit/d2b2f5eacab4dd48446b63340613b05dcbbf0b44" }, { "url": "https://github.com/python/cpython/commit/eee3ddf0ca10283cc7fea724aae9cd8665f8d15e" }, { "url": "https://github.com/python/cpython/issues/151987" }, { "url": "https://github.com/python/cpython/pull/151988" }, { "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/TWZW2PC2AZOV6FENIHFSRC63OM7MBGSB/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4360" }, { "url": "https://ubuntu.com/security/notices/USN-8744-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-4360" } ], "published": "2026-06-30T15:16:57+00:00", "updated": "2026-08-13T01:16:53+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-43894", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "nvd" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 6.2, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 190 ], "description": "jq is a command-line JSON processor. In 1.8.1 and earlier, when decNumberFromString is given a number literal of INT_MAX-1 (2147483646) digits, the D2U() macro overflows during signed-int arithmetic. The wrapped negative value bypasses the heap-allocation size check, causes the function to use a 30-byte stack buffer, and then writes \u2248715 million 16-bit units (\u22481.4 GiB) at an offset 1.43 GiB below the stack frame. The written content is fully attacker-controlled (the parsed decimal digits, packed 3-per-unit).", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-43894" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-43894" }, { "url": "https://github.com/jqlang/jq/security/advisories/GHSA-5v7p-2r57-2g4g" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43894" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-43894" } ], "published": "2026-05-11T18:16:37+00:00", "updated": "2026-06-17T10:50:02+00:00", "affects": [ { "ref": "pkg:rpm/redhat/jq@1.6-19.el9_8.2?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "1.6-19.el9_8.2", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/jq@1.6-19.el9_8.2?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-43895", "ratings": [ { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 4.4, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 20, 158 ], "description": "jq is a command-line JSON processor. In 1.8.1 and earlier, jq accepts embedded NUL bytes in import paths at the jq-language level, but later resolves those paths through C string operations during module and data-file lookup. This creates a mismatch between the logical import string that policy or audit code may validate and the on-disk path that jq actually opens.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-43895" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-43895" }, { "url": "https://github.com/jqlang/jq/commit/9d223f153c3632a207fa071caaa6292da33ae361" }, { "url": "https://github.com/jqlang/jq/security/advisories/GHSA-7q7g-mrq3-phxr" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43895" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-43895" } ], "published": "2026-05-11T18:16:37+00:00", "updated": "2026-06-17T10:50:02+00:00", "affects": [ { "ref": "pkg:rpm/redhat/jq@1.6-19.el9_8.2?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "1.6-19.el9_8.2", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/jq@1.6-19.el9_8.2?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-43896", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "nvd" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 674 ], "description": "jq is a command-line JSON processor. In 1.8.1 and earlier, unbounded recursion in jv_object_merge_recursive() allows a crafted jq program to crash the process with a segfault. The function is reachable through the * operator when both operands are objects.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-43896" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-43896" }, { "url": "https://github.com/jqlang/jq/commit/532ccea6080ed6758f39fe9f6208a44b665023d2" }, { "url": "https://github.com/jqlang/jq/security/advisories/GHSA-mg96-6h3q-g846" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43896" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-43896" } ], "published": "2026-05-11T18:16:37+00:00", "updated": "2026-06-17T10:50:02+00:00", "affects": [ { "ref": "pkg:rpm/redhat/jq@1.6-19.el9_8.2?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "1.6-19.el9_8.2", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/jq@1.6-19.el9_8.2?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-44777", "ratings": [ { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "nvd" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 674 ], "description": "jq is a command-line JSON processor. In 1.8.2rc1 and earlier, the ordinary module loader recurses without cycle detection when two\notherwise valid modules include each other.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-44777" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-44777" }, { "url": "https://github.com/jqlang/jq/commit/f58787c41835d9b17795730cb04925fdba25c71c" }, { "url": "https://github.com/jqlang/jq/security/advisories/GHSA-rmpv-jgvr-wpr9" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44777" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-44777" } ], "published": "2026-05-11T18:16:38+00:00", "updated": "2026-06-17T10:51:19+00:00", "affects": [ { "ref": "pkg:rpm/redhat/jq@1.6-19.el9_8.2?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "1.6-19.el9_8.2", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/jq@1.6-19.el9_8.2?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-45409", "ratings": [ { "source": { "name": "alma" }, "severity": "medium" }, { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "ghsa" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "nvd" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "oracle-oval" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "rocky" }, "severity": "medium" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 1333 ], "description": "Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as `\"\\u0660\" * N` or `\"\\u30fb\" * N + \"\\u6f22\"` utilize the `valid_contexto` function prior to length rejection, and for high values of `N` will take a long time to process. This is the same issue as CVE-2024-3651, however the original remediation in 2024 was not a complete fix. A specially crafted argument to the `idna.encode()` function could consume significant resources. This may lead to a denial-of-service. Starting in version 3.14, the function rejects long inputs as soon as practicable prior to any further processing to minimize resource consumption. In version 3.15, this approach was extended to lesser used alternate functions (i.e. per-label conversions and codec support). A workaround is available. Domain names cannot exceed 253 characters in length. If this length limit is enforced prior to passing the domain to the `idna.encode()` function, it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-45409" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54484" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-45409" }, { "url": "https://advisory.echohq.com/cve/CVE-2026-45409" }, { "url": "https://bugzilla.redhat.com/2485616" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2485616" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45409" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-54484.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:54484" }, { "url": "https://github.com/kjd/idna" }, { "url": "https://github.com/kjd/idna/security/advisories/GHSA-65pc-fj4g-8rjx" }, { "url": "https://github.com/pypa/advisory-database/tree/main/vulns/idna/PYSEC-2026-215.yaml" }, { "url": "https://linux.oracle.com/cve/CVE-2026-45409.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-54484.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45409" }, { "url": "https://ubuntu.com/security/notices/USN-8549-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-45409" } ], "published": "2026-06-05T23:16:43+00:00", "updated": "2026-07-23T07:10:00+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python3-pip-wheel@21.3.1-2.el9_8?arch=noarch&distro=redhat-9.8", "versions": [ { "version": "21.3.1-2.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-2.el9_8?arch=noarch&distro=redhat-9.8" } ] }, { "id": "CVE-2026-47770", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "nvd" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "cwes": [ 674 ], "description": "jq is a command-line JSON processor. Prior to 1.8.2, comparing two sufficiently deeply nested arrays with the == operator exhausts the C stack on jq's ordinary command-line surface, resulting in denial of service via stack exhaustion (uncontrolled recursion). The crash occurs in jq's recursive structural comparison code, with the recursion repeating through jvp_array_equal() and jv_equal() in src/jv.c when comparing deeply nested arrays; a nearby sort comparator path through jv_cmp() in src/jv_aux.c overflows the stack at a larger nesting depth from the same missing recursion guard. Anyone running jq comparisons on attacker-controlled deeply nested JSON values, or embedding jq in a context where untrusted data can reach the == comparison path, is affected. This vulnerability is fixed in 1.8.2.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-47770" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-47770" }, { "url": "https://github.com/jqlang/jq/security/advisories/GHSA-3pgx-frr7-3jxp" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47770" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-47770" } ], "published": "2026-06-25T18:16:38+00:00", "updated": "2026-06-26T19:16:41+00:00", "affects": [ { "ref": "pkg:rpm/redhat/jq@1.6-19.el9_8.2?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "1.6-19.el9_8.2", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/jq@1.6-19.el9_8.2?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-4873", "ratings": [ { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 319, 295 ], "description": "A vulnerability exists where a connection requiring TLS incorrectly reuses an\nexisting unencrypted connection from the same connection pool. If an initial\ntransfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request\nto that same host bypasses the TLS requirement and instead transmit data\nunencrypted.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-4873" }, { "url": "http://www.openwall.com/lists/oss-security/2026/04/29/7" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-4873" }, { "url": "https://curl.se/docs/CVE-2026-4873.html" }, { "url": "https://curl.se/docs/CVE-2026-4873.json" }, { "url": "https://github.com/advisories/GHSA-5fgw-rv54-prjx" }, { "url": "https://hackerone.com/reports/3621851" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4873" }, { "url": "https://ubuntu.com/security/notices/USN-8227-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-4873" } ], "published": "2026-05-13T13:01:55+00:00", "updated": "2026-09-15T07:16:28+00:00", "affects": [ { "ref": "pkg:rpm/redhat/curl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "7.76.1-40.el9_8.7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libcurl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "7.76.1-40.el9_8.7", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/curl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libcurl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-49839", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 6.6, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H" } ], "cwes": [ 787 ], "description": "jq is a command-line JSON processor. Prior to 1.8.2,` jq --rawfile` can turn a handled oversized-string error into invalid-state reuse and a real heap out-of-bounds write in assertion-disabled builds. When jv_load_file(raw=1) reads an attacker-controlled file, it repeatedly appends file chunks to the same jv string accumulator. Once jv_string_append_buf() returns jv_invalid_with_msg(\"String too long\"), the raw-file loop does not stop. If the file contains at least one more byte, the next loop iteration appends a new chunk to an object that is already invalid. With assertions enabled this aborts in jvp_string_ptr(). With assertions disabled, the invalid object is interpreted as a string object and ASan reports heap-buffer-overflow. This vulnerability is fixed in 1.8.2.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-49839" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-49839" }, { "url": "https://github.com/jqlang/jq/security/advisories/GHSA-cfh2-vwfq-qfmm" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49839" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-49839" } ], "published": "2026-06-25T18:16:38+00:00", "updated": "2026-06-26T18:53:19+00:00", "affects": [ { "ref": "pkg:rpm/redhat/jq@1.6-19.el9_8.2?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "1.6-19.el9_8.2", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/jq@1.6-19.el9_8.2?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-49919", "ratings": [ { "source": { "name": "redhat" }, "score": 5.8, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H" } ], "cwes": [ 190 ], "description": "In tt_face_colr_blend_layer of ttcolr.c, there is a possible remote code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-49919" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-49919" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49919" }, { "url": "https://source.android.com/docs/security/bulletin/2026/2026-09-01" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-49919" } ], "published": "2026-09-08T19:17:59+00:00", "updated": "2026-09-24T15:47:16+00:00", "affects": [ { "ref": "pkg:rpm/redhat/freetype@2.10.4-10.el9_5?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.10.4-10.el9_5", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/freetype@2.10.4-10.el9_5?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-50812", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 476 ], "description": "A NULL pointer dereference in the SQLite Session Extension in SQLite 3.53.1 and SQLite trunk builds before check-in e807d4e3798efd53 allows an attacker who can supply a malformed changeset blob to cause a denial of service. The issue occurs when sqlite3changeset_apply_v3() applies a corrupt changeset and reaches sqlite3_value_type() with a NULL sqlite3_value pointer.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-50812" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-50812" }, { "url": "https://gist.github.com/junius-sec/bb556f333957c5226dede314db0e9e91" }, { "url": "https://github.com/sqlite/sqlite/commit/b869ed6b067d623cb1383549f2a18aa35508385d" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50812" }, { "url": "https://sqlite.org/src/info/e807d4e3798efd53" }, { "url": "https://ubuntu.com/security/notices/USN-8565-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-50812" } ], "published": "2026-07-08T18:16:32+00:00", "updated": "2026-07-09T19:48:15+00:00", "affects": [ { "ref": "pkg:rpm/redhat/sqlite-libs@3.34.1-11.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.34.1-11.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/sqlite-libs@3.34.1-11.el9_8?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-53613", "ratings": [ { "source": { "name": "redhat" }, "score": 7, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "description": "When an /etc/fstab entry is configured with the user or users option, mount(8) validates the target path before performing the mount syscall, creating a Time-of-Check-Time-of-Use (TOCTOU) window. A local unprivileged user with write access to an ancestor directory of the mount target can swap that directory to redirect the mount to an arbitrary root-owned location, potentially escalating privileges to root.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-53613" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-53613" }, { "url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53613" }, { "url": "https://ubuntu.com/security/notices/USN-8702-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-53613" } ], "affects": [ { "ref": "pkg:rpm/redhat/libblkid@2.37.4-25.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.37.4-25.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libmount@2.37.4-25.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.37.4-25.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libuuid@2.37.4-25.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.37.4-25.el9", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libblkid@2.37.4-25.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libmount@2.37.4-25.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libuuid@2.37.4-25.el9?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-53655", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "nvd" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N" }, { "source": { "name": "redhat" }, "score": 6.1, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N" } ], "cwes": [ 436 ], "description": "node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar (node-tar) applies a PAX extended header's size= record (and other PAX overrides) to the next header entry of any type, including intermediary metadata headers such as a GNU long-name (L) or long-link (K) entry. Per POSIX pax, a PAX extended header (x) describes the next file entry, not the intermediary extension headers that may sit between the x header and the file it annotates. Because node-tar lets the PAX size override the byte length of an intervening L/K/x header, an attacker can desynchronize node-tar's stream cursor relative to every other mainstream tar implementation (GNU tar, libarchive/bsdtar, Python tarfile, and the now-fixed tar-rs / astral-tokio-tar). The result is a tar parser interpretation differential (CWE-436): a single crafted archive yields a different set of members under node-tar than under the reference tar tools. An attacker can use this to hide a member from one parser while it is visible to another, which defeats security tooling whose scanner and extractor disagree on archive contents (e.g. a malware/secret scanner that lists entries with one library while a downstream step extracts with another) This vulnerability is fixed in 7.5.16.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-53655" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-53655" }, { "url": "https://advisory.echohq.com/cve/CVE-2026-53655" }, { "url": "https://github.com/advisories/GHSA-vmf3-w455-68vh" }, { "url": "https://github.com/isaacs/node-tar" }, { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-vmf3-w455-68vh" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53655" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-53655" } ], "published": "2026-06-22T16:16:38+00:00", "updated": "2026-06-26T20:03:47+00:00", "affects": [ { "ref": "pkg:rpm/redhat/tar@1.34-13.el9_8?arch=x86_64&distro=redhat-9.8&epoch=2", "versions": [ { "version": "2:1.34-13.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/tar@1.34-13.el9_8?arch=x86_64&distro=redhat-9.8&epoch=2" } ] }, { "id": "CVE-2026-54679", "ratings": [ { "source": { "name": "nvd" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 190 ], "description": "jq is a command-line JSON processor. Prior to 1.8.2, on 32bit system, jvp_string_append has a chance of integer/multiple overflowing and then causing a massive buffer overrun. This vulnerability is fixed in 1.8.2.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-54679" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-54679" }, { "url": "https://github.com/jqlang/jq/security/advisories/GHSA-29gj-222p-j7vx" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54679" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-54679" } ], "published": "2026-06-25T18:16:40+00:00", "updated": "2026-06-26T18:53:32+00:00", "affects": [ { "ref": "pkg:rpm/redhat/jq@1.6-19.el9_8.2?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "1.6-19.el9_8.2", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/jq@1.6-19.el9_8.2?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-54872", "ratings": [ { "source": { "name": "redhat" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 208 ], "description": "Issue summary: The generic elliptic-curve scalar multiplication used for\nECDSA and SM2 signature operations with curves that do not have a dedicated\nimplementation leaks information about the secret nonce through timing.\n\nImpact summary: An attacker able to measure signing times may learn\ninformation about the per-signature secret nonce, which over many signatures\ncan, via a lattice / Hidden Number Problem attack, lead to recovery of the\nprivate key.\n\nCWE: CWE-208: Observable Timing Discrepancy\n\nDescription: The generic elliptic-curve scalar multiplication used for\ncurves that do not have a dedicated constant-time implementation pads the\nsecret scalar with non-constant-time BIGNUM operations, so the time taken\ndepends on the value of the secret scalar derived from the ECDSA and SM2 nonce.\n\nThe leak is very small; observing it requires a large number of\nmeasurements. The effect is largest for curves whose group order lies\non a machine-word boundary, such as brainpoolP384r1.\n\nApplications using ECDSA signing over the Brainpool and other generic prime\ncurves, and SM2 signing on platforms that use the generic implementation,\nare vulnerable to this issue.\n\nThe NIST curves P-256, P-384 and P-521 use dedicated constant-time\nimplementations and are not affected.\n\nFIPS Impact: no\nThe FIPS modules are not affected: the approved NIST curves used in the FIPS\nprovider have dedicated constant-time implementations and do not use the\naffected code path.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-54872" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-54872" }, { "url": "https://github.com/openssl/openssl/commit/1a5bee8dc57430a2be69cd1ffe7fec6a62f4f179" }, { "url": "https://github.com/openssl/openssl/commit/3f7e1363dccec6f7732bb9e9fa471bb6e4aa68cb" }, { "url": "https://github.com/openssl/openssl/commit/7d83bc7764999dfd91b83b4f0815b45390422afd" }, { "url": "https://github.com/openssl/openssl/commit/8166827a78aad164a07aa86dea2b425403ced471" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54872" }, { "url": "https://openssl-library.org/news/secadv/20260929.txt" }, { "url": "https://ubuntu.com/security/notices/USN-8847-1" }, { "url": "https://ubuntu.com/security/notices/USN-8847-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-54872" } ], "published": "2026-09-29T16:17:08+00:00", "updated": "2026-10-08T01:19:04+00:00", "affects": [ { "ref": "pkg:rpm/redhat/openssl-libs@3.5.8-1.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1", "versions": [ { "version": "1:3.5.8-1.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/openssl-libs@3.5.8-1.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-54873", "ratings": [ { "source": { "name": "redhat" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 770 ], "description": "Issue summary: QUIC process may keep memory for QUIC packet\nbuffer for much longer period than necessary.\n\nImpact summary: Remote peer can exploit this vulnerability\nby sending maliciously crafted packets, making the local\nQUIC stack to keep the memory for packet buffers allocated.\nThe time for which the memory remains allocated is entirely\nunder the control of the potentially malicious remote peer.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: To save copy operation from the packet buffer to the\nstream reassemble buffer the QUIC stack leaves the stream data\non the packet buffer waiting to be copied to a buffer provided\nby the local receiving application. The QUIC stack releases\na reference to the packet buffer only after the data are copied\nto the application buffer. This design is more efficient for\nlegitimate data transfers but enables an attacker to allocate a lot\nmore memory than actually required by the data kept in the receiving\nstream buffer.\n\nTo mitigate the vulnerability, the QUIC stack now calculates\nand monitors memory overhead for every stream. The memory overhead\nfor a single stream frame is calculated as a difference between the\nsize of the whole packet that carries the stream frame and the size\nof the stream frame itself. The memory overhead for a single stream\nframe is added to the total (cumulative) memory overhead QUIC stack\nkeeps for each stream. Once the cumulative memory overhead exceeds\n64kB, the QUIC stack moves the stream frame data from the packet\nbuffer to the stream buffer, starting with the next packet received.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-54873" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-54873" }, { "url": "https://github.com/openssl/openssl/commit/1f643b8bc735487b500a1f68a7fb3a22d5e38e23" }, { "url": "https://github.com/openssl/openssl/commit/279e7ee1392af98785746788168749491c74bd53" }, { "url": "https://github.com/openssl/openssl/commit/3ea6213e050e938ecbbf8c4eff32bec2736780eb" }, { "url": "https://github.com/openssl/openssl/commit/7127fb10888b49711c63128a09e524c0d2d5d0b2" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54873" }, { "url": "https://openssl-library.org/news/secadv/20260929.txt" }, { "url": "https://ubuntu.com/security/notices/USN-8861-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-54873" } ], "published": "2026-09-29T16:17:08+00:00", "updated": "2026-10-08T01:19:18+00:00", "affects": [ { "ref": "pkg:rpm/redhat/openssl-libs@3.5.8-1.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1", "versions": [ { "version": "1:3.5.8-1.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/openssl-libs@3.5.8-1.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-54875", "ratings": [ { "source": { "name": "redhat" }, "score": 4.7, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 208 ], "description": "Issue summary: A non-constant-time optimized implementation of scalar\npoint multiplication is used for SM2 private key operations on ARM64 and\nRISC-V platforms.\n\nImpact summary: An attacker able to measure the time taken by, or to observe\nthe cache-line access pattern of SM2 signing or decryption on an affected\nplatform can learn information about the secret scalar.\n\nCWE: CWE-208: Observable Timing Discrepancy\n\nDescription: On ARM64 and RISC-V processors, the SM2 curve uses an optimized\nscalar multiplication implementation whose conditional branches and table\nlook ups are chosen according to the bits of the secret scalar. The execution\ntime and the cache-access pattern therefore depend on the long-term private\nkey (during SM2 decryption) or the per-signature nonce (during SM2 signature\ngeneration), forming a timing and cache side-channel.\n\nFIPS Impact: no\nSM2 is not a FIPS algorithm and the optimized SM2 implementation is not part\nof the FIPS module.\n\nOpenSSL 4.0, 3.6, 3.5 and 3.4 are vulnerable to this issue on AArch64 and\nRISC-V.\n\nOpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue.\n\nOpenSSL 4.0 users should upgrade to OpenSSL 4.0.3.\nOpenSSL 3.6 users should upgrade to OpenSSL 3.6.5.\nOpenSSL 3.5 users should upgrade to OpenSSL 3.5.9.\nOpenSSL 3.4 users should upgrade to OpenSSL 3.4.8.\n\nThis issue was reported on 2 May 2026 by Abhinav Agarwal.\nIt was independently reported on 6 June 2026 by Feng Xue.\nThe fix was developed by Igor Ustinov.\n\n-- cut (non-publishing metadata for internal use) --\nReported by: Abhinav Agarwal, Feng Xue\nFixed by: Igor Ustinov", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-54875" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-54875" }, { "url": "https://github.com/openssl/openssl/commit/3f01bbc28f7e08211fcdc797fd43816504f94257" }, { "url": "https://github.com/openssl/openssl/commit/469f3e42629f4a0b5631796e20c66c92c138a3e8" }, { "url": "https://github.com/openssl/openssl/commit/9794ed473764839275cb701b4850f3c24d929c28" }, { "url": "https://github.com/openssl/openssl/commit/dddad955d5ff3e9507619cf4e0f13e9988e2197c" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54875" }, { "url": "https://openssl-library.org/news/secadv/20260929.txt" }, { "url": "https://ubuntu.com/security/notices/USN-8847-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-54875" } ], "published": "2026-09-29T16:17:08+00:00", "updated": "2026-10-08T01:19:29+00:00", "affects": [ { "ref": "pkg:rpm/redhat/openssl-libs@3.5.8-1.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1", "versions": [ { "version": "1:3.5.8-1.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/openssl-libs@3.5.8-1.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-5545", "ratings": [ { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N" }, { "source": { "name": "nvd" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 305, 613 ], "description": "libcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1's and user2's credentials when it is in fact\nstill using the connection authenticated for user1...", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-5545" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-5545" }, { "url": "https://curl.se/docs/CVE-2026-5545.html" }, { "url": "https://curl.se/docs/CVE-2026-5545.json" }, { "url": "https://github.com/advisories/GHSA-6g7g-56fm-f8mp" }, { "url": "https://hackerone.com/reports/3642555" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5545" }, { "url": "https://ubuntu.com/security/notices/USN-8227-1" }, { "url": "https://ubuntu.com/security/notices/USN-8525-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-5545" } ], "published": "2026-05-13T13:01:56+00:00", "updated": "2026-09-15T07:16:28+00:00", "affects": [ { "ref": "pkg:rpm/redhat/curl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "7.76.1-40.el9_8.7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libcurl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "7.76.1-40.el9_8.7", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/curl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libcurl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-56109", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 6.8, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 415 ], "description": "The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that allows attackers to corrupt memory by supplying maliciously crafted ALSA configuration text. When parsing nested compound or array configuration blocks, parse_def() fails to check return values before continuing, causing snd_config_delete() to be called twice on the same already-freed node, resulting in a NULL-pointer write or invalid memory read.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-56109" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-56109" }, { "url": "https://github.com/alsa-project/alsa-lib/commit/536dd6f8affdf5197c12a63a71c92a70b2833cc0" }, { "url": "https://github.com/alsa-project/alsa-lib/releases/tag/v1.2.16.1" }, { "url": "https://lore.kernel.org/alsa-devel/CAGt8pqBU0p2voB+qHxWGcNJrKHAcBhAyHUUBPLBN-Yj_SiV6MQ@mail.gmail.com/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56109" }, { "url": "https://ubuntu.com/security/notices/USN-8538-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-56109" }, { "url": "https://www.vulncheck.com/advisories/alsa-library-double-free-via-parse-def-in-conf-c" } ], "published": "2026-06-22T18:16:48+00:00", "updated": "2026-07-14T22:17:18+00:00", "affects": [ { "ref": "pkg:rpm/redhat/alsa-lib@1.2.15.3-1.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "1.2.15.3-1.el9", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/alsa-lib@1.2.15.3-1.el9?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-56131", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 4.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "source": { "name": "redhat" }, "score": 4.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 416 ], "description": "libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation).", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-56131" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-56131" }, { "url": "https://github.com/libexpat/libexpat/pull/1267" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56131" }, { "url": "https://ubuntu.com/security/notices/USN-8813-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-56131" } ], "published": "2026-06-19T06:17:10+00:00", "updated": "2026-06-23T20:15:48+00:00", "affects": [ { "ref": "pkg:rpm/redhat/expat@2.5.0-6.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.5.0-6.el9_8.3", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/expat@2.5.0-6.el9_8.3?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-56391", "ratings": [ { "source": { "name": "alma" }, "severity": "medium" }, { "source": { "name": "nvd" }, "score": 6.1, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H" }, { "source": { "name": "oracle-oval" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 6.1, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H" }, { "source": { "name": "rocky" }, "severity": "medium" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 125 ], "description": "GNU coreutils uniq is vulnerable to an out\u2011of\u2011bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-56391" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67886" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-56391" }, { "url": "https://bugzilla.redhat.com/2506691" }, { "url": "https://bugzilla.redhat.com/2506694" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506691" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506694" }, { "url": "https://cert.pl/en/posts/2026/07/CVE-2026-56391" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56391" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56392" }, { "url": "https://errata.almalinux.org/10/ALSA-2026-67886.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:67886" }, { "url": "https://git.savannah.gnu.org/cgit/coreutils.git" }, { "url": "https://git.savannah.gnu.org/cgit/coreutils.git/" }, { "url": "https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371" }, { "url": "https://github.com/advisories/GHSA-7xvj-m9x7-qgxq" }, { "url": "https://linux.oracle.com/cve/CVE-2026-56391.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-67886.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56391" }, { "url": "https://ubuntu.com/security/notices/USN-8697-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-56391" }, { "url": "https://www.openwall.com/lists/oss-security/2026/07/25/2" } ], "published": "2026-07-24T09:16:25+00:00", "updated": "2026-08-26T13:52:50+00:00", "affects": [ { "ref": "pkg:rpm/redhat/coreutils-common@8.32-41.el9_8.1?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "8.32-41.el9_8.1", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/coreutils@8.32-41.el9_8.1?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "8.32-41.el9_8.1", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/coreutils-single@8.32-41.el9_8.1?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "8.32-41.el9_8.1", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/coreutils-common@8.32-41.el9_8.1?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/coreutils@8.32-41.el9_8.1?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/coreutils-single@8.32-41.el9_8.1?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/coreutils-single@8.32-41.el9_8.1?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-56403", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 6.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L" }, { "source": { "name": "nvd" }, "score": 6.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L" }, { "source": { "name": "redhat" }, "score": 6.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 190 ], "description": "libexpat before 2.8.2 has an integer overflow in storeAtts.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-56403" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-56403" }, { "url": "https://github.com/libexpat/libexpat/pull/1232" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56403" }, { "url": "https://ubuntu.com/security/notices/USN-8790-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-56403" } ], "published": "2026-06-21T16:16:26+00:00", "updated": "2026-06-23T20:15:16+00:00", "affects": [ { "ref": "pkg:rpm/redhat/expat@2.5.0-6.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.5.0-6.el9_8.3", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/expat@2.5.0-6.el9_8.3?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-56404", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 6.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L" }, { "source": { "name": "nvd" }, "score": 6.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L" }, { "source": { "name": "redhat" }, "score": 6.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 190 ], "description": "libexpat before 2.8.2 has an integer overflow in addBinding.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-56404" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-56404" }, { "url": "https://github.com/libexpat/libexpat/pull/1249" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56404" }, { "url": "https://ubuntu.com/security/notices/USN-8790-1" }, { "url": "https://ubuntu.com/security/notices/USN-8872-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-56404" } ], "published": "2026-06-21T16:16:27+00:00", "updated": "2026-06-23T20:15:05+00:00", "affects": [ { "ref": "pkg:rpm/redhat/expat@2.5.0-6.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.5.0-6.el9_8.3", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/expat@2.5.0-6.el9_8.3?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-56405", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 6.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L" }, { "source": { "name": "nvd" }, "score": 6.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L" }, { "source": { "name": "redhat" }, "score": 4.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 190 ], "description": "libexpat before 2.8.2 has an integer overflow in getAttributeId.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-56405" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-56405" }, { "url": "https://github.com/libexpat/libexpat/pull/1251" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56405" }, { "url": "https://ubuntu.com/security/notices/USN-8790-1" }, { "url": "https://ubuntu.com/security/notices/USN-8872-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-56405" } ], "published": "2026-06-21T16:16:27+00:00", "updated": "2026-06-23T20:14:51+00:00", "affects": [ { "ref": "pkg:rpm/redhat/expat@2.5.0-6.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.5.0-6.el9_8.3", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/expat@2.5.0-6.el9_8.3?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-56406", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 6.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L" }, { "source": { "name": "redhat" }, "score": 6.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 190 ], "description": "libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-56406" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-56406" }, { "url": "https://github.com/libexpat/libexpat/pull/1255" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56406" }, { "url": "https://ubuntu.com/security/notices/USN-8813-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-56406" } ], "published": "2026-06-21T16:16:27+00:00", "updated": "2026-06-23T16:29:06+00:00", "affects": [ { "ref": "pkg:rpm/redhat/expat@2.5.0-6.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.5.0-6.el9_8.3", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/expat@2.5.0-6.el9_8.3?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-56407", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 6.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L" }, { "source": { "name": "redhat" }, "score": 6.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 190 ], "description": "libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-56407" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-56407" }, { "url": "https://github.com/libexpat/libexpat/pull/1262" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56407" }, { "url": "https://ubuntu.com/security/notices/USN-8813-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-56407" } ], "published": "2026-06-21T16:16:27+00:00", "updated": "2026-06-23T16:28:29+00:00", "affects": [ { "ref": "pkg:rpm/redhat/expat@2.5.0-6.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.5.0-6.el9_8.3", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/expat@2.5.0-6.el9_8.3?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-56412", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "source": { "name": "nvd" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "source": { "name": "redhat" }, "score": 4.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 416 ], "description": "libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-56412" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-56412" }, { "url": "https://github.com/libexpat/libexpat/pull/1278" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56412" }, { "url": "https://ubuntu.com/security/notices/USN-8790-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-56412" } ], "published": "2026-06-21T17:16:44+00:00", "updated": "2026-06-23T15:31:30+00:00", "affects": [ { "ref": "pkg:rpm/redhat/expat@2.5.0-6.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.5.0-6.el9_8.3", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/expat@2.5.0-6.el9_8.3?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-5713", "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 6, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N" }, { "source": { "name": "rocky" }, "severity": "high" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 121, 125 ], "description": "The \"profiling.sampling\" module (Python 3.15+) and \"asyncio introspection capabilities\" (3.14+, \"python -m asyncio ps\" and \"python -m asyncio pstree\") features could be used to read and write addresses in a privileged process if that process connected to a malicious or \"infected\" Python process via the remote debugging feature. This vulnerability requires persistently and repeatedly connecting to the process to be exploited, even after the connecting process crashes with high likelihood due to ASLR.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-5713" }, { "url": "http://www.openwall.com/lists/oss-security/2026/04/15/6" }, { "url": "https://access.redhat.com/errata/RHSA-2026:19176" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-5713" }, { "url": "https://bugzilla.redhat.com/2431367" }, { "url": "https://bugzilla.redhat.com/2444691" }, { "url": "https://bugzilla.redhat.com/2448168" }, { "url": "https://bugzilla.redhat.com/2448181" }, { "url": "https://bugzilla.redhat.com/2449649" }, { "url": "https://bugzilla.redhat.com/2457409" }, { "url": "https://bugzilla.redhat.com/2457932" }, { "url": "https://bugzilla.redhat.com/2458049" }, { "url": "https://bugzilla.redhat.com/2458239" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431367" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444691" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448168" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448181" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449649" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457409" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457932" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458049" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458239" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0865" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1502" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2297" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3644" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4224" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4519" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4786" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5713" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6100" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-19176.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:19176" }, { "url": "https://github.com/python/cpython/commit/289fd2c97a7e5aecb8b69f94f5e838ccfeee7e67" }, { "url": "https://github.com/python/cpython/commit/316f6265b7f9ca4ffed5346b747475ef1943f35d" }, { "url": "https://github.com/python/cpython/issues/148178" }, { "url": "https://github.com/python/cpython/pull/148187" }, { "url": "https://linux.oracle.com/cve/CVE-2026-5713.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-19176.html" }, { "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/OG4RHARYSNIE22GGOMVMCRH76L5HKPLM/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5713" }, { "url": "https://ubuntu.com/security/notices/USN-8509-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-5713" } ], "published": "2026-04-14T16:16:48+00:00", "updated": "2026-07-31T14:16:50+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-57585", "ratings": [ { "source": { "name": "azure" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 416 ], "description": "MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack. If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-57585" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-57585" }, { "url": "https://github.com/msgpack/msgpack-python/commit/2c56ddb5d0025ed481d962c0f5d62d19dec7476d" }, { "url": "https://github.com/msgpack/msgpack-python/security/advisories/GHSA-6v7p-g79w-8964" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57585" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-57585" } ], "published": "2026-06-30T22:16:57+00:00", "updated": "2026-08-06T15:51:03+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python3-pip-wheel@21.3.1-2.el9_8?arch=noarch&distro=redhat-9.8", "versions": [ { "version": "21.3.1-2.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-2.el9_8?arch=noarch&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-5773", "ratings": [ { "source": { "name": "julia" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "source": { "name": "nvd" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 488, 918 ], "description": "libcurl might in some circumstances reuse the wrong connection for SMB(S)\ntransfers.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a network transfer operation that was requested by an\napplication could wrongfully reuse an existing SMB connection to the same\nserver that was using a different \"share\" than the new subsequent transfer\nshould.\n\nThis could in unlucky situations lead to the download of the wrong file or the\nupload of a file to the wrong place. When this happens, the same credentials\nare used and the server name is the same.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-5773" }, { "url": "http://www.openwall.com/lists/oss-security/2026/04/29/9" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-5773" }, { "url": "https://curl.se/docs/CVE-2026-5773.html" }, { "url": "https://curl.se/docs/CVE-2026-5773.json" }, { "url": "https://github.com/advisories/GHSA-rp9q-8q5w-ch44" }, { "url": "https://hackerone.com/reports/3650689" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5773" }, { "url": "https://ubuntu.com/security/notices/USN-8227-1" }, { "url": "https://ubuntu.com/security/notices/USN-8525-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-5773" } ], "published": "2026-05-13T13:01:56+00:00", "updated": "2026-09-15T07:16:28+00:00", "affects": [ { "ref": "pkg:rpm/redhat/curl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "7.76.1-40.el9_8.7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libcurl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "7.76.1-40.el9_8.7", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/curl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libcurl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-58470", "ratings": [ { "source": { "name": "julia" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "redhat" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 190 ], "description": "GNU Wget through 1.25.0, fixed in commit 43d3ba9, contains an integer overflow vulnerability in the parse_content_range() function within src/http.c that allows server-controlled values to cause signed integer arithmetic to overflow. Attackers can supply malicious Content-Range header values to trigger undefined behavior and download desynchronization in the affected client.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-58470" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-58470" }, { "url": "https://github.com/advisories/GHSA-5f52-px6m-c5hw" }, { "url": "https://gitlab.com/gnuwget/wget/-/commit/43d3ba9336bc94937e6fae2365c6ffd30c34ffcf" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58470" }, { "url": "https://ubuntu.com/security/notices/USN-8543-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-58470" }, { "url": "https://www.vulncheck.com/advisories/gnu-wget-integer-overflow-via-content-range-header-parsing" } ], "published": "2026-07-07T21:17:28+00:00", "updated": "2026-07-09T16:01:18+00:00", "affects": [ { "ref": "pkg:rpm/redhat/wget@1.21.1-11.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "1.21.1-11.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/wget@1.21.1-11.el9_8?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-5958", "ratings": [ { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "redhat" }, "score": 6.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 367 ], "description": "When sed is invoked with both -i (in-place edit) and --follow-symlinks, the function open_next_file() performs two separate, non-atomic filesystem operations on the same path: \n1. resolves symlink to its target and stores\u00a0the resolved path for determining when output is written,\n2. opens the original symlink path\u00a0(not the resolved one) to read the file. \nBetween these two calls there is a race window. If an attacker atomically replaces the symlink with a different target during that window, sed will: read content from the new (attacker-chosen) symlink target and write the processed result to the path recorded in step 1.\u00a0This can lead to arbitrary file overwrite with attacker-controlled content in the context of the sed process.\n\n\nThis issue was fixed in version 4.10.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-5958" }, { "url": "http://www.openwall.com/lists/oss-security/2026/05/13/1" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-5958" }, { "url": "https://cert.pl/en/posts/2026/04/CVE-2026-5958" }, { "url": "https://github.com/advisories/GHSA-9r7w-j29g-xqx8" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5958" }, { "url": "https://ubuntu.com/security/notices/USN-8229-1" }, { "url": "https://ubuntu.com/security/notices/USN-8229-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-5958" }, { "url": "https://www.gnu.org/software/sed" }, { "url": "https://www.gnu.org/software/sed/" } ], "published": "2026-04-20T12:16:08+00:00", "updated": "2026-06-17T10:59:56+00:00", "affects": [ { "ref": "pkg:rpm/redhat/sed@4.8-10.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "4.8-10.el9", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/sed@4.8-10.el9?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-59871", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "ghsa" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "nvd" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "cwes": [ 704 ], "description": "node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-59871" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-59871" }, { "url": "https://advisory.echohq.com/cve/CVE-2026-59871" }, { "url": "https://github.com/advisories/GHSA-w8wr-v893-vjvp" }, { "url": "https://github.com/isaacs/node-tar" }, { "url": "https://github.com/isaacs/node-tar/commit/e02a4e9e013c4be95302e2eb2047a942b883c27b" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.18" }, { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-w8wr-v893-vjvp" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59871" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-59871" } ], "published": "2026-07-08T16:16:33+00:00", "updated": "2026-07-10T19:02:55+00:00", "affects": [ { "ref": "pkg:rpm/redhat/tar@1.34-13.el9_8?arch=x86_64&distro=redhat-9.8&epoch=2", "versions": [ { "version": "2:1.34-13.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/tar@1.34-13.el9_8?arch=x86_64&distro=redhat-9.8&epoch=2" } ] }, { "id": "CVE-2026-59875", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "ghsa" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "redhat" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "cwes": [ 248 ], "description": "node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.lstat or fs.open and terminate the process with an uncaught exception. This issue is fixed in version 7.5.17.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-59875" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-59875" }, { "url": "https://advisory.echohq.com/cve/CVE-2026-59875" }, { "url": "https://github.com/advisories/GHSA-gvwx-54wh-qm9j" }, { "url": "https://github.com/isaacs/node-tar" }, { "url": "https://github.com/isaacs/node-tar/commit/7a635c29f5edbf083557374d43984273ecfed5b3" }, { "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.17" }, { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-gvwx-54wh-qm9j" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59875" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-59875" } ], "published": "2026-07-08T16:16:34+00:00", "updated": "2026-07-10T19:10:59+00:00", "affects": [ { "ref": "pkg:rpm/redhat/tar@1.34-13.el9_8?arch=x86_64&distro=redhat-9.8&epoch=2", "versions": [ { "version": "2:1.34-13.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/tar@1.34-13.el9_8?arch=x86_64&distro=redhat-9.8&epoch=2" } ] }, { "id": "CVE-2026-6019", "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "bitnami" }, "score": 6.1, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "source": { "name": "nvd" }, "score": 6.1, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 6.8, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N" }, { "source": { "name": "rocky" }, "severity": "high" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 150, 116 ], "description": "http.cookies.Morsel.js_output() returns an inline inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-6019" }, { "url": "https://access.redhat.com/errata/RHSA-2026:28247" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-6019" }, { "url": "https://bugzilla.redhat.com/2458049" }, { "url": "https://bugzilla.redhat.com/2460869" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458049" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460869" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4786" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6019" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-28247.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:28247" }, { "url": "https://github.com/python/cpython/commit/3c59b8b53fc75c7f9578d16fb8201ceb43e8f76c" }, { "url": "https://github.com/python/cpython/commit/76b3923d688c0efc580658476c5f525ec8735104" }, { "url": "https://github.com/python/cpython/commit/f795e042043dfe26c42e1971d4502c1cdc4c65b8" }, { "url": "https://github.com/python/cpython/issues/90309" }, { "url": "https://github.com/python/cpython/pull/148848" }, { "url": "https://linux.oracle.com/cve/CVE-2026-6019.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-28581.html" }, { "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/IVNWGV2BBNC3RHQAFS22UP4DY56SAXX3/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6019" }, { "url": "https://ubuntu.com/security/notices/USN-8509-1" }, { "url": "https://ubuntu.com/security/notices/USN-8744-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-6019" } ], "published": "2026-04-22T20:16:42+00:00", "updated": "2026-07-27T17:34:54+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-6253", "ratings": [ { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 522 ], "description": "curl might erroneously pass on credentials for a first proxy to a second\nproxy.\n\nThis can happen when the following conditions are true:\n\n1. curl is setup to use specific different proxies for different URL schemes\n2. the first proxy needs credentials\n3. the second proxy uses no credentials\n4. while using the first proxy (using say `http://`), curl is asked to follow\n a redirect to a URL using another scheme (say `https://`), accessed using a\n second, different, proxy", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-6253" }, { "url": "http://www.openwall.com/lists/oss-security/2026/04/29/11" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-6253" }, { "url": "https://curl.se/docs/CVE-2026-6253.html" }, { "url": "https://curl.se/docs/CVE-2026-6253.json" }, { "url": "https://hackerone.com/reports/3669637" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6253" }, { "url": "https://ubuntu.com/security/notices/USN-8227-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-6253" } ], "published": "2026-05-13T13:01:56+00:00", "updated": "2026-09-15T07:16:29+00:00", "affects": [ { "ref": "pkg:rpm/redhat/curl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "7.76.1-40.el9_8.7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libcurl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "7.76.1-40.el9_8.7", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/curl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libcurl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-6276", "ratings": [ { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "nvd" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 3.7, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 346, 319 ], "description": "Using libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-6276" }, { "url": "http://www.openwall.com/lists/oss-security/2026/04/29/13" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-6276" }, { "url": "https://curl.se/docs/CVE-2026-6276.html" }, { "url": "https://curl.se/docs/CVE-2026-6276.json" }, { "url": "https://github.com/advisories/GHSA-2jc6-hc33-hv48" }, { "url": "https://hackerone.com/reports/3671818" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6276" }, { "url": "https://ubuntu.com/security/notices/USN-8227-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-6276" } ], "published": "2026-05-13T13:01:56+00:00", "updated": "2026-09-15T07:16:29+00:00", "affects": [ { "ref": "pkg:rpm/redhat/curl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "7.76.1-40.el9_8.7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libcurl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "7.76.1-40.el9_8.7", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/curl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libcurl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-6368", "ratings": [ { "source": { "name": "alma" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "rocky" }, "severity": "medium" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 908 ], "description": "Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43\u00a0can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.", "recommendation": "Upgrade glibc to version 2.34-283.el9_8; Upgrade glibc-common to version 2.34-283.el9_8; Upgrade glibc-minimal-langpack to version 2.34-283.el9_8", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-6368" }, { "url": "https://access.redhat.com/errata/RHSA-2026:76777" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-6368" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513603" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513608" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6368" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6791" }, { "url": "https://errata.almalinux.org/8/ALSA-2026-76777.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:76777" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6368" }, { "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34090" }, { "url": "https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2026-0014" }, { "url": "https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2026-0014;h=1e9a0039f07471ddfe6816e5df04875bec409f92;hb=HEAD" }, { "url": "https://ubuntu.com/security/notices/USN-8737-1" }, { "url": "https://ubuntu.com/security/notices/USN-8737-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-6368" } ], "published": "2026-08-10T19:17:30+00:00", "updated": "2026-09-03T16:43:15+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-6390", "ratings": [ { "source": { "name": "redhat" }, "score": 6.8, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 134 ], "description": "A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to achieve stack information disclosure, cause a denial of service (crash), or potentially perform arbitrary memory writes.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-6390" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-6390" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458767" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6390" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-6390" } ], "published": "2026-07-23T05:16:38+00:00", "updated": "2026-09-01T13:19:56+00:00", "affects": [ { "ref": "pkg:rpm/redhat/nano@5.6.1-7.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "5.6.1-7.el9", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/nano@5.6.1-7.el9?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-6429", "ratings": [ { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 200 ], "description": "When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, libcurl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-6429" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-6429" }, { "url": "https://curl.se/docs/CVE-2026-6429.html" }, { "url": "https://curl.se/docs/CVE-2026-6429.json" }, { "url": "https://github.com/advisories/GHSA-2pvc-5qw9-h3ph" }, { "url": "https://hackerone.com/reports/3677759" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6429" }, { "url": "https://ubuntu.com/security/notices/USN-8227-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-6429" } ], "published": "2026-05-13T13:01:56+00:00", "updated": "2026-09-15T07:16:29+00:00", "affects": [ { "ref": "pkg:rpm/redhat/curl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "7.76.1-40.el9_8.7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libcurl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "7.76.1-40.el9_8.7", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/curl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libcurl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-66046", "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "high" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "rocky" }, "severity": "high" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 407 ], "description": "Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.", "recommendation": "Upgrade expat to version 2.5.0-6.el9_8.5", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-66046" }, { "url": "https://access.redhat.com/errata/RHSA-2026:72663" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-66046" }, { "url": "https://bugzilla.redhat.com/2538967" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517901" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2538967" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-66046" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93990" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-72663.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:72663" }, { "url": "https://github.com/libexpat/libexpat/pull/1321" }, { "url": "https://linux.oracle.com/cve/CVE-2026-66046.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-74001.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66046" }, { "url": "https://ubuntu.com/security/notices/USN-8813-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-66046" }, { "url": "https://www.vulncheck.com/advisories/expat-denial-of-service-via-storeatts-quadratic-complexity" } ], "published": "2026-08-18T15:16:57+00:00", "updated": "2026-09-18T15:07:24+00:00", "affects": [ { "ref": "pkg:rpm/redhat/expat@2.5.0-6.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.5.0-6.el9_8.3", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/expat@2.5.0-6.el9_8.3?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-67693", "ratings": [ { "source": { "name": "redhat" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "description": "An issue in gnutls v.3.8.13 allows an attacker to obtain sensitive information via failing to reject end-entity X.509 certificates that contain a contradictory combination of Key Usage (KU) and Extended Key Usage (EKU)", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-67693" }, { "url": "http://gnutls.com" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-67693" }, { "url": "https://gist.github.com/lkloliver/6fbfc191bc6163942c8017551ac3f238" }, { "url": "https://gitlab.com/gnutls/gnutls/-/blob/3.8.13/lib/x509/verify.c#L1119-1178" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67693" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-67693" } ], "published": "2026-10-08T19:18:41+00:00", "updated": "2026-10-08T21:33:42+00:00", "affects": [ { "ref": "pkg:rpm/redhat/gnutls@3.8.10-8.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.8.10-8.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/gnutls@3.8.10-8.el9_8?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-6791", "ratings": [ { "source": { "name": "alma" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "rocky" }, "severity": "medium" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 121 ], "description": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash.", "recommendation": "Upgrade glibc to version 2.34-283.el9_8; Upgrade glibc-common to version 2.34-283.el9_8; Upgrade glibc-minimal-langpack to version 2.34-283.el9_8", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-6791" }, { "url": "https://access.redhat.com/errata/RHSA-2026:76777" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-6791" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513603" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513608" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6368" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6791" }, { "url": "https://errata.almalinux.org/8/ALSA-2026-76777.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:76777" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6791" }, { "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34091" }, { "url": "https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2026-0013" }, { "url": "https://ubuntu.com/security/notices/USN-8737-1" }, { "url": "https://ubuntu.com/security/notices/USN-8737-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-6791" } ], "published": "2026-08-10T19:17:30+00:00", "updated": "2026-09-03T16:43:15+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-6842", "ratings": [ { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "redhat" }, "score": 2.5, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 732 ], "description": "A flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions (0777 instead of 0700) for the `~/.local` directory. This allows the attacker to inject a malicious `.desktop` launcher, which could lead to unintended actions or information disclosure if the launcher is subsequently processed.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-6842" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-6842" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455314" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460018" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6842" }, { "url": "https://ubuntu.com/security/notices/USN-8386-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-6842" } ], "published": "2026-04-22T08:16:13+00:00", "updated": "2026-09-01T13:19:56+00:00", "affects": [ { "ref": "pkg:rpm/redhat/nano@5.6.1-7.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "5.6.1-7.el9", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/nano@5.6.1-7.el9?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-6843", "ratings": [ { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 134 ], "description": "A flaw was found in nano. A local user could exploit a format string vulnerability in the `statusline()` function. By creating a directory with a name containing `printf` specifiers, the application attempts to display this name, leading to a segmentation fault (SEGV). This results in a Denial of Service (DoS) for the `nano` application.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-6843" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-6843" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460017" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6843" }, { "url": "https://ubuntu.com/security/notices/USN-8386-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-6843" } ], "published": "2026-04-22T09:16:26+00:00", "updated": "2026-09-01T12:17:44+00:00", "affects": [ { "ref": "pkg:rpm/redhat/nano@5.6.1-7.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "5.6.1-7.el9", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/nano@5.6.1-7.el9?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-7168", "ratings": [ { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "julia" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "source": { "name": "nvd" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 294 ], "description": "Successfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-7168" }, { "url": "http://www.openwall.com/lists/oss-security/2026/04/29/14" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-7168" }, { "url": "https://curl.se/docs/CVE-2026-7168.html" }, { "url": "https://curl.se/docs/CVE-2026-7168.json" }, { "url": "https://github.com/advisories/GHSA-v92m-hrhj-gw54" }, { "url": "https://hackerone.com/reports/3697719" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7168" }, { "url": "https://ubuntu.com/security/notices/USN-8227-1" }, { "url": "https://ubuntu.com/security/notices/USN-8525-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-7168" } ], "published": "2026-05-13T13:01:57+00:00", "updated": "2026-09-15T07:16:29+00:00", "affects": [ { "ref": "pkg:rpm/redhat/curl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "7.76.1-40.el9_8.7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libcurl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "7.76.1-40.el9_8.7", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/curl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libcurl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-7210", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "bitnami" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "nvd" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "cwes": [ 331 ], "description": "`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-7210" }, { "url": "http://www.openwall.com/lists/oss-security/2026/05/11/13" }, { "url": "http://www.openwall.com/lists/oss-security/2026/05/11/8" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-7210" }, { "url": "https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4" }, { "url": "https://github.com/python/cpython/commit/3573b3b1ecbd99030a0b18658e1bfece771b2566" }, { "url": "https://github.com/python/cpython/commit/cbaecf9f16da611a646d507c1cbca265c588fc56" }, { "url": "https://github.com/python/cpython/commit/e37df2a6a71d6538698e2d3188a7c345b827640b" }, { "url": "https://github.com/python/cpython/commit/ea70712d1a8508e14e9677d44f838dab04dc0286" }, { "url": "https://github.com/python/cpython/commit/eeea765cb9d8f1fc3d8918b272ac3c477983f27a" }, { "url": "https://github.com/python/cpython/commit/fc9b11ff49cbc82e6f917d07a61517a2b5f3145f" }, { "url": "https://github.com/python/cpython/issues/149018" }, { "url": "https://github.com/python/cpython/pull/149023" }, { "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/PNY5OMBDPM2FRUZTWFFPJ6LISWKV627K/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7210" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-7210" } ], "published": "2026-05-11T18:16:42+00:00", "updated": "2026-10-02T01:16:44+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-72897", "ratings": [ { "source": { "name": "redhat" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 787 ], "description": "Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a\nconnection to a different SSL_CTX part way through a handshake may access\nmemory beyond the end of an internal array if the replacement context knows\nabout more provider signature algorithms than the context the connection was\ncreated from. Applications which never call SSL_set_SSL_CTX() are not\naffected.\n\nImpact summary: A remote peer may be able to cause a small out-of-bounds\nread, and in some circumstances a fixed-value out-of-bounds write, on the\nserver heap. This may lead to a Denial of Service.\n\nCWE: CWE-787: Out-of-bounds Write\n\nDescription: A TLS connection records how many certificate slots it has\nwhen it is created, taken from the SSL_CTX that created it: the built-in\ncertificate types plus one slot for each provider TLS-SIGALG entry that\ncontext was aware of. That count sizes an internal array of per-slot\ncertificate validity flags.\n\nAn application may replace a connection's SSL_CTX part way through the\nhandshake by calling SSL_set_SSL_CTX(), most commonly from a servername\ncallback in order to serve a different virtual host. Doing so did not\nrefresh the recorded count. A provider signature algorithm's slot index is\nits position in the list of whichever context resolves it, so if the\nreplacement context is aware of more of them than the original, an\nalgorithm offered by the peer can resolve to an index beyond the end of the\narray. Processing the peer's signature algorithms then reads one four byte\nword past the end for each such algorithm and, where the word read is zero,\nwrites a fixed value over it. A peer offering many of them can corrupt heap\nmetadata and abort the process.\n\nOnly provider signature algorithms which occupy one of the excess slots,\nand which the server also has configured, have this effect. Codepoints the\nreplacement context does not recognise are discarded without being resolved\nto a slot, and provider signature algorithms are usable only from TLS 1.3.\n\nThe two contexts must therefore be aware of different numbers of provider\nsignature algorithms, which requires separate library contexts, a provider\nloaded between the two being created, or providers which differ in what\nthey advertise - in 4.0, for example, the default provider advertises SM2\nwhere the FIPS provider does not. A deployment meeting the condition is\nalso unable to negotiate the affected algorithms with legitimate clients,\nsince the same stale count hides the corresponding certificates, so the\nmisconfiguration is likely to be noticed. For that reason, and because the\nconfiguration is not the default, this issue has been assessed as Low\nseverity.\n\nFIPS impact: no\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-72897" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-72897" }, { "url": "https://github.com/openssl/openssl/commit/00646e5085a0d12d29e0d2f9b9bc5f7111a50922" }, { "url": "https://github.com/openssl/openssl/commit/4135f553c9d3ba4a09fe752f5d30af2a6a092b2e" }, { "url": "https://github.com/openssl/openssl/commit/9c54d209486f6b1ad79fe2179c40f13200fa4f61" }, { "url": "https://github.com/openssl/openssl/commit/e87ed26b298a74d8ba61a53e9c7bcd1acac6b814" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72897" }, { "url": "https://openssl-library.org/news/secadv/20260929.txt" }, { "url": "https://ubuntu.com/security/notices/USN-8847-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-72897" } ], "published": "2026-09-29T16:17:09+00:00", "updated": "2026-10-08T01:19:41+00:00", "affects": [ { "ref": "pkg:rpm/redhat/openssl-libs@3.5.8-1.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1", "versions": [ { "version": "1:3.5.8-1.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/openssl-libs@3.5.8-1.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-74860", "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "high" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 8.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H" }, { "source": { "name": "rocky" }, "severity": "high" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 763 ], "description": "A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.", "recommendation": "Upgrade libxml2 to version 2.9.13-14.el9_8.5", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-74860" }, { "url": "https://access.redhat.com/errata/RHSA-2026:64463" }, { "url": "https://access.redhat.com/errata/RHSA-2026:71585" }, { "url": "https://access.redhat.com/errata/RHSA-2026:71586" }, { "url": "https://access.redhat.com/errata/RHSA-2026:71641" }, { "url": "https://access.redhat.com/errata/RHSA-2026:72470" }, { "url": "https://access.redhat.com/errata/RHSA-2026:72475" }, { "url": "https://access.redhat.com/errata/RHSA-2026:72476" }, { "url": "https://access.redhat.com/errata/RHSA-2026:79357" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-74860" }, { "url": "https://bugzilla.redhat.com/2528986" }, { "url": "https://bugzilla.redhat.com/2528987" }, { "url": "https://bugzilla.redhat.com/2528989" }, { "url": "https://bugzilla.redhat.com/2528990" }, { "url": "https://bugzilla.redhat.com/2528992" }, { "url": "https://bugzilla.redhat.com/2529697" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528986" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528987" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528989" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528990" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528992" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529697" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74860" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86138" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86140" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86142" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86143" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86144" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-71585.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:71585" }, { "url": "https://linux.oracle.com/cve/CVE-2026-74860.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-71641.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74860" }, { "url": "https://ubuntu.com/security/notices/USN-8787-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-74860" } ], "published": "2026-09-08T12:16:58+00:00", "updated": "2026-10-09T02:17:04+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.4?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.9.13-14.el9_8.4", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.4?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-75803", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 3.7, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 354 ], "description": "Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty\nciphertext can report success without verifying the supplied authentication\ntag when the operation is finalized by calling the EVP_Cipher() function.\n\nImpact summary: Applications calling EVP_Cipher() on an empty ciphertext and\nexpecting the call to check the AEAD tag may accept forged messages.\n\nCWE: CWE-354 (Improper Validation of Integrity Check Value)\n\nDescription: The EVP_Cipher() API call for AEAD ciphers behaves like a one\nshot encryption and decryption call. It also verifies the AEAD tag after the\ndecryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphers\nit skipped the AEAD tag verification when an empty ciphertext was passed to\nthe function. The callers of this function might believe that a successful\nreturn indicates a valid AEAD tag for these ciphers, even when that has not\ntruly been validated in this case.\n\nFIPS impact: no\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE\nas the affected algorithms are not FIPS approved and thus not implemented\nin the FIPS module.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-75803" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-75803" }, { "url": "https://github.com/openssl/openssl/commit/119ab9555dc62275bbd71f6f49529b1a44feba42" }, { "url": "https://github.com/openssl/openssl/commit/3621257986e27e540bf96a11570929a6e5a9e05b" }, { "url": "https://github.com/openssl/openssl/commit/6c7aa6f8f6449b7fe0137ee8be65fcd239bd7d6a" }, { "url": "https://github.com/openssl/openssl/commit/bdeb0cd994d915342787f117ee75044f0dc36f34" }, { "url": "https://github.com/openssl/openssl/commit/bf95f5f772e9362f87b25cfa2f8cb15d984865b9" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75803" }, { "url": "https://openssl-library.org/news/secadv/20260825.txt" }, { "url": "https://ubuntu.com/security/notices/USN-8678-1" }, { "url": "https://ubuntu.com/security/notices/USN-8678-3" }, { "url": "https://ubuntu.com/security/notices/USN-8865-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-75803" } ], "published": "2026-08-25T13:19:29+00:00", "updated": "2026-09-11T21:17:17+00:00", "affects": [ { "ref": "pkg:rpm/redhat/openssl-libs@3.5.8-1.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1", "versions": [ { "version": "1:3.5.8-1.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/openssl-libs@3.5.8-1.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-75804", "ratings": [ { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 770 ], "description": "Issue summary: OpenSSL QUIC stack does not enforce connection\nlevel flow control for streams. Remote peers may send more bytes\nas long as they fit within the stream flow control limits.\n\nImpact summary: A malicious remote peer may exploit the lack of connection\nflow control for streams to make the QUIC stack receive ~100MB of memory\ninstead of 768 KiB (default flow control window size).\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: The local QUIC stack advertises two flow control limits\nto its remote peer: stream flow control limit and connection flow\ncontrol limit. The remote peer must follow both limits when transmitting\nstream data.\n\nWhenever the local QUIC stack receives a stream frame, it validates\nthat the size of the received stream frame stays within flow control limits.\nIf either limit is exceeded (stream level or connection level), then\nthe QUIC stack must close the connection with a flow control error.\n\nThe vulnerable OpenSSL QUIC stack enforces the stream-level but not\nthe connection-level limit. To exploit the issue, three conditions must be met:\n - the remote peer opens several streams\n - each stream must stay within the stream-level flow control limit\n - there must be no zero-offset byte sent on any of the streams\n (to prevent the vulnerable QUIC stack from consuming data).\nBy meeting the conditions above, the remote peer may make the local stack\nallocate 2 x MAX_STREAMS x (stream flow control limit) bytes\nof memory. MAX_STREAMS defaults to 100, and the limit applies to both\nbidirectional and unidirectional streams, making it 200 in total. The default\nflow control window for a stream is 512kB. The remote peer may\nforce the vulnerable QUIC stack to allocate 100MB of heap per connection.\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-75804" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-75804" }, { "url": "https://github.com/openssl/openssl/commit/2e8f54666b3fb7b05ff5f58aa6cac9285163654e" }, { "url": "https://github.com/openssl/openssl/commit/4533ee8a5686c953ed3b644738ac4bdf20806538" }, { "url": "https://github.com/openssl/openssl/commit/64d3102fb5b54311e92517f26ba00169d719e74a" }, { "url": "https://github.com/openssl/openssl/commit/f9eaecf5bdd6692da052bc65b0332af2a938ac03" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75804" }, { "url": "https://openssl-library.org/news/secadv/20260929.txt" }, { "url": "https://ubuntu.com/security/notices/USN-8847-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-75804" } ], "published": "2026-09-29T16:17:10+00:00", "updated": "2026-10-08T01:20:01+00:00", "affects": [ { "ref": "pkg:rpm/redhat/openssl-libs@3.5.8-1.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1", "versions": [ { "version": "1:3.5.8-1.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/openssl-libs@3.5.8-1.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-75805", "ratings": [ { "source": { "name": "redhat" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 476 ], "description": "Issue summary: A CMP client that requests certificate revocation on the basis\nof a PKCS#10 CSR may dereference a NULL pointer and terminate abnormally when\nprocessing a crafted revocation response. \n\nImpact summary: The NULL pointer dereference happens on a read which \nleads to a crash and a Denial of Service for the affected client application.\n\nCWE: CWE-476: NULL-pointer dereference\n\nDescription: A CMP client revoking a certificate has to tell the server which\ncertificate to revoke, and may do so by supplying a PKCS#10 CSR instead of the\ncertificate itself or its issuer name and serial number. This is\n'openssl cmp -cmd rr -csr ' on the command line, or\nOSSL_CMP_exec_RR_ses() with the certificate supplied via\nOSSL_CMP_CTX_set1_p10CSR() through the API.\n\nA CSR does not contain the issuer name and serial number of the certificate,\nso the client does not send them. A server may optionally name the\ncertificate it revoked in its response, and the client then compares that\nname against what it sent. Having sent neither an issuer name nor a serial\nnumber, it has nothing to compare against, and a server returning a specially\ncrafted name causes the client to read from a NULL pointer and crash.\n\nThe revocation response is checked for valid message protection before\nthe affected code is reached, so an attacker must be a malicious or\ncompromised CMP server, or a man-in-the-middle in possession of the\nsecret used for message protection. Clients that identify the certificate\nto be revoked by a certificate or by issuer and serial number rather\nthan by a PKCS#10 CSR are not affected.\n\nFIPS impact: no\nNo FIPS modules are affected by this issue, as the CMP protocol\nimplementation is outside the OpenSSL FIPS module boundary.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-75805" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-75805" }, { "url": "https://github.com/openssl/openssl/commit/7588db7fef14209c3caa3a101d11a02006b19166" }, { "url": "https://github.com/openssl/openssl/commit/7ca0ccb5172a577e9b87267d77bfe21e5481a5e7" }, { "url": "https://github.com/openssl/openssl/commit/9eb2a8a9b86136cdb39d6d7d50644dd66941cdc3" }, { "url": "https://github.com/openssl/openssl/commit/abf02872a4b71767ecc72293424420f5b009190f" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75805" }, { "url": "https://openssl-library.org/news/secadv/20260929.txt" }, { "url": "https://ubuntu.com/security/notices/USN-8847-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-75805" } ], "published": "2026-09-29T16:17:11+00:00", "updated": "2026-10-08T01:20:24+00:00", "affects": [ { "ref": "pkg:rpm/redhat/openssl-libs@3.5.8-1.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1", "versions": [ { "version": "1:3.5.8-1.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/openssl-libs@3.5.8-1.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-75806", "ratings": [ { "source": { "name": "redhat" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 1284 ], "description": "Issue summary: An established DTLS 1.2 association using an AEAD cipher suite\ncan be terminated by a single unauthenticated datagram whose encrypted\nfragment is shorter than the mandatory explicit IV and authentication tag\noverhead.\n\nImpact summary: An attacker who can send a datagram that is routed to an\nexisting DTLS 1.2 association can tear that association down without knowing\nany key material. This is a Denial of Service limited to the targeted\nassociation. There is no memory safety or confidentiality impact.\n\nCWE: CWE-1284: Improper Validation of Specified Quantity in Input\n\nDescription: In TLS 1.2 and DTLS 1.2 every record protected by an AEAD cipher\nsuite carries an explicit IV followed by the ciphertext and an authentication\ntag. When decrypting such a record the record layer passed the record length to\nthe cipher implementation before checking that the record was long enough to\ncontain the explicit IV and the tag. For a record shorter than that overhead the\ncipher implementation rejected the impossible length, and the record layer\ntreated this as an internal failure and raised a fatal internal_error alert\ninstead of treating the record as one that failed authentication.\n\nIn TLS 1.2 the same record causes a fatal internal_error alert instead of the\nexpected bad_record_mac alert. Since any undecryptable record already\nterminates a TLS connection, this is a protocol conformance issue rather than\na security issue in TLS.\n\nThe fix validates the record length against the explicit IV and tag length\nbefore any AEAD processing, so that TLS reports bad_record_mac and DTLS\nsilently discards the record.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-75806" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-75806" }, { "url": "https://github.com/openssl/openssl/commit/04728a289a823e68137f88da016cb9ede307217d" }, { "url": "https://github.com/openssl/openssl/commit/050b275cd671a6eed1d6457642d41a5a77aab972" }, { "url": "https://github.com/openssl/openssl/commit/3a4589d015a9049d47b66f186cf50a8711343a1d" }, { "url": "https://github.com/openssl/openssl/commit/5af82fefbaf2b5fec2fc0e1d87f112844902f01d" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75806" }, { "url": "https://openssl-library.org/news/secadv/20260929.txt" }, { "url": "https://ubuntu.com/security/notices/USN-8847-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-75806" } ], "published": "2026-09-29T16:17:11+00:00", "updated": "2026-10-08T01:20:33+00:00", "affects": [ { "ref": "pkg:rpm/redhat/openssl-libs@3.5.8-1.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1", "versions": [ { "version": "1:3.5.8-1.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/openssl-libs@3.5.8-1.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-76641", "ratings": [ { "source": { "name": "azure" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 125 ], "description": "Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-76641" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-76641" }, { "url": "https://github.com/libexpat/libexpat/commit/98599f6dcc2b460410881fe420f5f55d6bec63bf" }, { "url": "https://github.com/libexpat/libexpat/pull/1331" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76641" }, { "url": "https://ubuntu.com/security/notices/USN-8813-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-76641" }, { "url": "https://www.vulncheck.com/advisories/expat-out-of-bounds-read-via-dtdcopy" } ], "published": "2026-08-20T18:16:51+00:00", "updated": "2026-09-24T20:02:50+00:00", "affects": [ { "ref": "pkg:rpm/redhat/expat@2.5.0-6.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.5.0-6.el9_8.3", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/expat@2.5.0-6.el9_8.3?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-76957", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "nvd" }, "score": 7.8, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": { "name": "redhat" }, "score": 4.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 416 ], "description": "libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-76957" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-76957" }, { "url": "https://github.com/libexpat/libexpat/pull/1322" }, { "url": "https://github.com/libexpat/libexpat/pull/1329" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76957" }, { "url": "https://ubuntu.com/security/notices/USN-8813-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-76957" } ], "published": "2026-08-20T05:16:29+00:00", "updated": "2026-09-08T20:56:31+00:00", "affects": [ { "ref": "pkg:rpm/redhat/expat@2.5.0-6.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.5.0-6.el9_8.3", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/expat@2.5.0-6.el9_8.3?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-77117", "ratings": [ { "source": { "name": "redhat" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 835 ], "description": "Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.\n\nSome SHIFT_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used. The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489.", "recommendation": "Upgrade glibc to version 2.34-283.el9_8; Upgrade glibc-common to version 2.34-283.el9_8; Upgrade glibc-minimal-langpack to version 2.34-283.el9_8", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-77117" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-77117" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77117" }, { "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34556" }, { "url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0019" }, { "url": "https://ubuntu.com/security/notices/USN-8737-1" }, { "url": "https://ubuntu.com/security/notices/USN-8737-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-77117" } ], "published": "2026-09-15T11:17:12+00:00", "updated": "2026-09-18T18:17:47+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-77214", "ratings": [ { "source": { "name": "redhat" }, "score": 8.2, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L" } ], "cwes": [ 125 ], "description": "libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-77214" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-77214" }, { "url": "https://github.com/libexpat/libexpat/commit/13c5f63a7f1c52c2feee3b16a1134d4fb68e9ea0" }, { "url": "https://github.com/libexpat/libexpat/pull/1393" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77214" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-77214" }, { "url": "https://www.vulncheck.com/advisories/libexpat-heap-buffer-over-read-in-xmlparse-c-via-xml-parsebuffer" } ], "published": "2026-10-07T15:17:53+00:00", "updated": "2026-10-07T15:57:20+00:00", "affects": [ { "ref": "pkg:rpm/redhat/expat@2.5.0-6.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.5.0-6.el9_8.3", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/expat@2.5.0-6.el9_8.3?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-77696", "ratings": [ { "source": { "name": "redhat" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 208 ], "description": "Issue summary: SM2 signature generation uses non-constant-time arithmetic\non secret values, forming a timing side-channel.\n\nImpact summary: An attacker able to measure SM2 signing times may learn\ninformation about the per-signature secret nonce, which over many signatures\ncan, via a lattice / Hidden Number Problem attack, lead to recovery of the\nprivate key.\n\nCWE: CWE-208: Observable Timing Discrepancy\n\nDescription: SM2 signature generation computes the signature value using\nvariable-time BIGNUM operations on the secret nonce and the private key, so\nthe time taken to produce an SM2 signature depends on these secret values,\nforming a timing side-channel.\n\nApplications performing SM2 signature generation are affected on all\nplatforms.\n\nFIPS Impact: no\nSM2 is not a FIPS algorithm.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-77696" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-77696" }, { "url": "https://github.com/openssl/openssl/commit/1c4aed808a7aea32d2d013049c2e0d9fef164fc9" }, { "url": "https://github.com/openssl/openssl/commit/20b20628d39b2dcc4677194bd68c7c060fa598cb" }, { "url": "https://github.com/openssl/openssl/commit/419f5cb519721dceed393dbc524d79e487c72e64" }, { "url": "https://github.com/openssl/openssl/commit/6b90445a56b99a328ac1feba058abf976504f440" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77696" }, { "url": "https://openssl-library.org/news/secadv/20260929.txt" }, { "url": "https://ubuntu.com/security/notices/USN-8847-1" }, { "url": "https://ubuntu.com/security/notices/USN-8847-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-77696" } ], "published": "2026-09-29T16:17:11+00:00", "updated": "2026-10-08T01:20:41+00:00", "affects": [ { "ref": "pkg:rpm/redhat/openssl-libs@3.5.8-1.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1", "versions": [ { "version": "1:3.5.8-1.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/openssl-libs@3.5.8-1.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-7774", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 22 ], "description": "tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extracting process.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-7774" }, { "url": "http://www.openwall.com/lists/oss-security/2026/06/04/9" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-7774" }, { "url": "https://github.com/python/cpython/commit/0478bd83d82b255e0f29f613367a59d261e7eaa2" }, { "url": "https://github.com/python/cpython/commit/0d28f5e46e151718972dfabd91205444d0037b6d" }, { "url": "https://github.com/python/cpython/commit/10a13bee3c24f9c62b602e696334ff2272a40efc" }, { "url": "https://github.com/python/cpython/commit/578411982c16f753f4893532510099ef665117da" }, { "url": "https://github.com/python/cpython/commit/5cf47a248c35c375d610b87b2f72fd1ed454b558" }, { "url": "https://github.com/python/cpython/commit/74cca9a92fb7d653e404843a56b8bdc7b0afdbbf" }, { "url": "https://github.com/python/cpython/commit/c063191cb7f9170f9565e305f8aa2b79ab2bf609" }, { "url": "https://github.com/python/cpython/issues/149486" }, { "url": "https://github.com/python/cpython/pull/149487" }, { "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/4FU62L2M6RMMHT2QPGQNPEHHUND7CEX5/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7774" }, { "url": "https://ubuntu.com/security/notices/USN-8509-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-7774" }, { "url": "https://www.openwall.com/lists/oss-security/2026/06/04/9" } ], "published": "2026-06-04T16:16:42+00:00", "updated": "2026-08-13T01:16:55+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.9.25-7.el9_8.3", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-devel@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3-libs@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/python3@3.9.25-7.el9_8.3?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-78659", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [], "description": "When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"Trailer\" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.", "recommendation": "Upgrade golang.org/x/net to version 0.60.0", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-78659" }, { "url": "https://go.dev/cl/847185" }, { "url": "https://go.dev/cl/847314" }, { "url": "https://go.dev/issue/81857" }, { "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI" }, { "url": "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs" }, { "url": "https://pkg.go.dev/vuln/GO-2026-6603" } ], "published": "2026-10-08T23:17:03+00:00", "updated": "2026-10-08T23:17:03+00:00", "affects": [ { "ref": "pkg:golang/golang.org/x/net@v0.58.0", "versions": [ { "version": "v0.58.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/net@v0.58.0", "versions": [ { "version": "v0.58.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/net@v0.58.0", "versions": [ { "version": "v0.58.0", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.25.11", "versions": [ { "version": "v1.25.11", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:golang/golang.org/x/net@v0.58.0" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:golang/stdlib@v1.25.11" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:golang/golang.org/x/net@v0.58.0" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-78660", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [], "description": "Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.", "recommendation": "Upgrade golang.org/x/net to version 0.60.0", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-78660" }, { "url": "https://go.dev/cl/835145" }, { "url": "https://go.dev/cl/836385" }, { "url": "https://go.dev/issue/81115" }, { "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI" }, { "url": "https://pkg.go.dev/vuln/GO-2026-6610" } ], "published": "2026-10-08T23:17:03+00:00", "updated": "2026-10-08T23:17:03+00:00", "affects": [ { "ref": "pkg:golang/golang.org/x/net@v0.58.0", "versions": [ { "version": "v0.58.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/net@v0.58.0", "versions": [ { "version": "v0.58.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/net@v0.58.0", "versions": [ { "version": "v0.58.0", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.25.11", "versions": [ { "version": "v1.25.11", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:golang/golang.org/x/net@v0.58.0" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:golang/stdlib@v1.25.11" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:golang/golang.org/x/net@v0.58.0" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-78663", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [], "description": "The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.", "recommendation": "Upgrade golang.org/x/net to version 0.60.0", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-78663" }, { "url": "https://go.dev/cl/847187" }, { "url": "https://go.dev/cl/847310" }, { "url": "https://go.dev/issue/81743" }, { "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI" }, { "url": "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs" }, { "url": "https://pkg.go.dev/vuln/GO-2026-6612" } ], "published": "2026-10-08T23:17:03+00:00", "updated": "2026-10-08T23:17:03+00:00", "affects": [ { "ref": "pkg:golang/golang.org/x/net@v0.58.0", "versions": [ { "version": "v0.58.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/net@v0.58.0", "versions": [ { "version": "v0.58.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/net@v0.58.0", "versions": [ { "version": "v0.58.0", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.25.11", "versions": [ { "version": "v1.25.11", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:golang/golang.org/x/net@v0.58.0" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:golang/stdlib@v1.25.11" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:golang/golang.org/x/net@v0.58.0" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-78669", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [], "description": "A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.", "recommendation": "Upgrade golang.org/x/net to version 0.60.0", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-78669" }, { "url": "https://go.dev/cl/847186" }, { "url": "https://go.dev/cl/847308" }, { "url": "https://go.dev/issue/81742" }, { "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI" }, { "url": "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs" }, { "url": "https://pkg.go.dev/vuln/GO-2026-6611" } ], "published": "2026-10-08T23:17:04+00:00", "updated": "2026-10-08T23:17:04+00:00", "affects": [ { "ref": "pkg:golang/golang.org/x/net@v0.58.0", "versions": [ { "version": "v0.58.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/net@v0.58.0", "versions": [ { "version": "v0.58.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/net@v0.58.0", "versions": [ { "version": "v0.58.0", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.25.11", "versions": [ { "version": "v1.25.11", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:golang/golang.org/x/net@v0.58.0" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:golang/stdlib@v1.25.11" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:golang/golang.org/x/net@v0.58.0" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-80230", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 3.7, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 295 ], "description": "When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable\nstandard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and\n`CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on\nconnections established without a presented server certificate. Bypassing the\npinning check under these disabled-verification conditions allows\nunauthenticated connections to succeed when they should be rejected.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-80230" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-80230" }, { "url": "https://curl.se/docs/CVE-2026-80230.html" }, { "url": "https://curl.se/docs/CVE-2026-80230.json" }, { "url": "https://github.com/curl/curl/commit/5267ed859d545534d0c21" }, { "url": "https://hackerone.com/reports/3969300" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80230" }, { "url": "https://ubuntu.com/security/notices/USN-8820-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-80230" } ], "published": "2026-09-06T18:17:22+00:00", "updated": "2026-09-15T07:16:30+00:00", "affects": [ { "ref": "pkg:rpm/redhat/curl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "7.76.1-40.el9_8.7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libcurl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "7.76.1-40.el9_8.7", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/curl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libcurl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-80489", "ratings": [ { "source": { "name": "redhat" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 835 ], "description": "Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.\n\nSome EUC_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the EUC_JISX0213 character set is affected, which is not commonly used. The related defect in SHIFT_JISX0213 converter is tracked separately as CVE-2026-77117.", "recommendation": "Upgrade glibc to version 2.34-283.el9_8; Upgrade glibc-common to version 2.34-283.el9_8; Upgrade glibc-minimal-langpack to version 2.34-283.el9_8", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-80489" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-80489" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80489" }, { "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34568" }, { "url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0020" }, { "url": "https://ubuntu.com/security/notices/USN-8737-1" }, { "url": "https://ubuntu.com/security/notices/USN-8737-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-80489" } ], "published": "2026-09-15T11:17:12+00:00", "updated": "2026-09-18T18:17:47+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-81870", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "ratings": [ { "source": { "name": "redhat" }, "score": 3.3, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" } ], "cwes": [ 200, 532 ], "description": "OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal Info-level diagnostic event whose MarshalLog implementations recursively include span processor, exporter, and client configuration. Applications that call otel.SetLogger to enable OpenTelemetry internal Info logging can therefore record OTLP gRPC and HTTP collector endpoints, the OTLP HTTP Insecure flag, and complete Zipkin collector URLs. A person or system with access to those logs can learn internal collector topology and can recover credentials or tokens embedded in Zipkin URL user information or query strings. The default OpenTelemetry logger does not emit the event, and this path does not log OTLP authentication headers, TLS key material, or span payloads. This issue is fixed in version 1.45.0.", "recommendation": "Upgrade go.opentelemetry.io/otel/sdk to version 1.45.0", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-81870" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-81870" }, { "url": "https://github.com/open-telemetry/opentelemetry-go" }, { "url": "https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38" }, { "url": "https://github.com/open-telemetry/opentelemetry-go/pull/8438" }, { "url": "https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0" }, { "url": "https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0" }, { "url": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81870" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-81870" } ], "published": "2026-09-16T20:17:32+00:00", "updated": "2026-09-30T17:51:56+00:00", "affects": [ { "ref": "pkg:golang/go.opentelemetry.io/otel/sdk@v1.44.0", "versions": [ { "version": "v1.44.0", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:golang/go.opentelemetry.io/otel/sdk@v1.44.0" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:golang/go.opentelemetry.io/otel/sdk@v1.44.0" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-82209", "ratings": [ { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 3.1, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 201 ], "description": "When libpsl support is enabled, libcurl fails to enforce the Public Suffix\nList boundary check when processing a `Set-Cookie` header where the `Domain`\nattribute explicitly matches an origin host that is itself a public suffix\n(e.g., `Domain=co.uk` set by `co.uk`).\n\nInstead of coercing it into a strict host-only cookie, libcurl saves the\ncookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is\ninappropriately included in subsequent outbound requests or HTTP redirects to\narbitrary sibling subdomains under the same public suffix (e.g.,\n`attacker.co.uk`).", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-82209" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-82209" }, { "url": "https://curl.se/docs/CVE-2026-82209.html" }, { "url": "https://curl.se/docs/CVE-2026-82209.json" }, { "url": "https://github.com/curl/curl/commit/95c1e8915dce64606bd753fd47f" }, { "url": "https://hackerone.com/reports/3972385" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82209" }, { "url": "https://ubuntu.com/security/notices/USN-8820-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-82209" } ], "published": "2026-09-06T18:17:22+00:00", "updated": "2026-09-15T07:16:31+00:00", "affects": [ { "ref": "pkg:rpm/redhat/curl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "7.76.1-40.el9_8.7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libcurl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "7.76.1-40.el9_8.7", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/curl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libcurl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-84782", "ratings": [ { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 7.4, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H" }, { "source": { "name": "rocky" }, "severity": "high" }, { "source": { "name": "ubuntu" }, "severity": "high" } ], "cwes": [ 125 ], "description": "Issue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary.", "recommendation": "Upgrade openssl-libs to version 1:3.5.8-2.el9_8", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-84782" }, { "url": "https://access.redhat.com/errata/RHSA-2026:76918" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-84782" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2537080" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-84782" }, { "url": "https://errata.rockylinux.org/RLSA-2026:76918" }, { "url": "https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943" }, { "url": "https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628" }, { "url": "https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58" }, { "url": "https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c" }, { "url": "https://linux.oracle.com/cve/CVE-2026-84782.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-77396.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84782" }, { "url": "https://openssl-library.org/news/secadv/20260929.txt" }, { "url": "https://openssl-library.org/news/vulnerabilities/#CVE-2026-84782" }, { "url": "https://ubuntu.com/security/notices/USN-8847-1" }, { "url": "https://ubuntu.com/security/notices/USN-8847-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-84782" } ], "published": "2026-09-29T16:17:12+00:00", "updated": "2026-10-08T01:20:56+00:00", "affects": [ { "ref": "pkg:rpm/redhat/openssl-libs@3.5.8-1.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1", "versions": [ { "version": "1:3.5.8-1.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/openssl-libs@3.5.8-1.el9_8?arch=x86_64&distro=redhat-9.8&epoch=1" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-86138", "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "nvd" }, "score": 7.8, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 6.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L" }, { "source": { "name": "rocky" }, "severity": "high" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 190 ], "description": "In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.", "recommendation": "Upgrade libxml2 to version 2.9.13-14.el9_8.5", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-86138" }, { "url": "https://access.redhat.com/errata/RHSA-2026:71585" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-86138" }, { "url": "https://bugzilla.redhat.com/2528986" }, { "url": "https://bugzilla.redhat.com/2528987" }, { "url": "https://bugzilla.redhat.com/2528989" }, { "url": "https://bugzilla.redhat.com/2528990" }, { "url": "https://bugzilla.redhat.com/2528992" }, { "url": "https://bugzilla.redhat.com/2529697" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528986" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528987" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528989" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528990" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528992" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529697" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74860" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86138" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86140" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86142" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86143" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86144" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-71585.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:71585" }, { "url": "https://github.com/GNOME/libxml2/commit/a4cba4b5b5a8c42e155ed42d2d2a44955465a2e4" }, { "url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4" }, { "url": "https://linux.oracle.com/cve/CVE-2026-86138.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-71641.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86138" }, { "url": "https://ubuntu.com/security/notices/USN-8910-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-86138" } ], "published": "2026-09-05T05:17:12+00:00", "updated": "2026-09-15T19:40:47+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.4?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.9.13-14.el9_8.4", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.4?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-86140", "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "high" }, { "source": { "name": "nvd" }, "score": 7.8, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 7.4, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": { "name": "rocky" }, "severity": "high" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 121 ], "description": "In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.", "recommendation": "Upgrade libxml2 to version 2.9.13-14.el9_8.5", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-86140" }, { "url": "https://access.redhat.com/errata/RHSA-2026:71585" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-86140" }, { "url": "https://bugzilla.redhat.com/2528986" }, { "url": "https://bugzilla.redhat.com/2528987" }, { "url": "https://bugzilla.redhat.com/2528989" }, { "url": "https://bugzilla.redhat.com/2528990" }, { "url": "https://bugzilla.redhat.com/2528992" }, { "url": "https://bugzilla.redhat.com/2529697" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528986" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528987" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528989" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528990" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528992" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529697" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74860" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86138" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86140" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86142" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86143" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86144" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-71585.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:71585" }, { "url": "https://github.com/GNOME/libxml2/commit/d1686f91dbda141a752200419d35639fd6b38340" }, { "url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4" }, { "url": "https://linux.oracle.com/cve/CVE-2026-86140.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-71641.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86140" }, { "url": "https://ubuntu.com/security/notices/USN-8787-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-86140" } ], "published": "2026-09-05T05:17:12+00:00", "updated": "2026-09-15T19:39:17+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.4?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.9.13-14.el9_8.4", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.4?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-86142", "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "nvd" }, "score": 7.8, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 6.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L" }, { "source": { "name": "rocky" }, "severity": "high" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 122 ], "description": "In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.", "recommendation": "Upgrade libxml2 to version 2.9.13-14.el9_8.5", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-86142" }, { "url": "https://access.redhat.com/errata/RHSA-2026:71585" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-86142" }, { "url": "https://bugzilla.redhat.com/2528986" }, { "url": "https://bugzilla.redhat.com/2528987" }, { "url": "https://bugzilla.redhat.com/2528989" }, { "url": "https://bugzilla.redhat.com/2528990" }, { "url": "https://bugzilla.redhat.com/2528992" }, { "url": "https://bugzilla.redhat.com/2529697" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528986" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528987" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528989" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528990" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528992" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529697" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74860" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86138" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86140" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86142" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86143" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86144" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-71585.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:71585" }, { "url": "https://github.com/GNOME/libxml2/commit/6b3a736c0edc74ceec3d82f5252499d7911b3a58" }, { "url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4" }, { "url": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1113" }, { "url": "https://linux.oracle.com/cve/CVE-2026-86142.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-71586.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86142" }, { "url": "https://ubuntu.com/security/notices/USN-8910-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-86142" } ], "published": "2026-09-05T05:17:13+00:00", "updated": "2026-09-15T19:35:48+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.4?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.9.13-14.el9_8.4", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.4?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-86143", "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "nvd" }, "score": 7.3, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 6.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L" }, { "source": { "name": "rocky" }, "severity": "high" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 192 ], "description": "In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback.", "recommendation": "Upgrade libxml2 to version 2.9.13-14.el9_8.5", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-86143" }, { "url": "https://access.redhat.com/errata/RHSA-2026:71585" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-86143" }, { "url": "https://bugzilla.redhat.com/2528986" }, { "url": "https://bugzilla.redhat.com/2528987" }, { "url": "https://bugzilla.redhat.com/2528989" }, { "url": "https://bugzilla.redhat.com/2528990" }, { "url": "https://bugzilla.redhat.com/2528992" }, { "url": "https://bugzilla.redhat.com/2529697" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528986" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528987" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528989" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528990" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528992" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529697" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74860" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86138" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86140" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86142" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86143" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86144" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-71585.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:71585" }, { "url": "https://github.com/GNOME/libxml2/commit/90f293ba74d28b1d570920382e707586f68ebf35" }, { "url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4" }, { "url": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1111" }, { "url": "https://linux.oracle.com/cve/CVE-2026-86143.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-71641.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86143" }, { "url": "https://ubuntu.com/security/notices/USN-8910-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-86143" } ], "published": "2026-09-05T05:17:13+00:00", "updated": "2026-09-15T19:31:15+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.4?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.9.13-14.el9_8.4", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.4?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-86144", "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "nvd" }, "score": 7.8, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 5.6, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L" }, { "source": { "name": "rocky" }, "severity": "high" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 669 ], "description": "In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow).", "recommendation": "Upgrade libxml2 to version 2.9.13-14.el9_8.5", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-86144" }, { "url": "https://access.redhat.com/errata/RHSA-2026:71585" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-86144" }, { "url": "https://bugzilla.redhat.com/2528986" }, { "url": "https://bugzilla.redhat.com/2528987" }, { "url": "https://bugzilla.redhat.com/2528989" }, { "url": "https://bugzilla.redhat.com/2528990" }, { "url": "https://bugzilla.redhat.com/2528992" }, { "url": "https://bugzilla.redhat.com/2529697" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528986" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528987" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528989" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528990" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528992" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529697" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74860" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86138" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86140" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86142" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86143" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86144" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-71585.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:71585" }, { "url": "https://github.com/GNOME/libxml2/commit/b63cd517afecb76582dd9488c55e54ceaf50de61" }, { "url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4" }, { "url": "https://linux.oracle.com/cve/CVE-2026-86144.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-71641.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86144" }, { "url": "https://ubuntu.com/security/notices/USN-8910-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-86144" } ], "published": "2026-09-05T05:17:13+00:00", "updated": "2026-09-15T19:20:15+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.4?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.9.13-14.el9_8.4", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_8.4?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-86145", "ratings": [ { "source": { "name": "azure" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 8.2, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 424 ], "description": "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-86145" }, { "url": "http://www.openwall.com/lists/oss-security/2026/09/05/3" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-86145" }, { "url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48" }, { "url": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86145" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-86145" } ], "published": "2026-09-05T06:17:10+00:00", "updated": "2026-09-09T16:04:24+00:00", "affects": [ { "ref": "pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8", "versions": [ { "version": "10.40-6.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "10.40-6.el9", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-86469", "ratings": [ { "source": { "name": "redhat" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 59 ], "description": "A flaw was found in GLib2. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION and creating the .goutputstream-XXXXXX temporary file fails, the library unlinks the destination and recreates it without exclusive creation or symlink protection. A local attacker who can write to the destination directory can win that race and redirect the write to another file.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-86469" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-86469" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2473839" }, { "url": "https://gitlab.gnome.org/GNOME/glib/-/blob/main/gio/glocalfileoutputstream.c" }, { "url": "https://gitlab.gnome.org/GNOME/glib/-/work_items/4044" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86469" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-86469" } ], "published": "2026-09-07T16:17:30+00:00", "updated": "2026-09-08T19:08:15+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glib2@2.68.4-19.el9_8.10?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.68.4-19.el9_8.10", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/glib2@2.68.4-19.el9_8.10?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-8674", "ratings": [ { "source": { "name": "redhat" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 617 ], "description": "Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.\n\nThe resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration. The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion. Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes. Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-8674" }, { "url": "http://www.openwall.com/lists/oss-security/2026/09/17/4" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-8674" }, { "url": "https://joshua.hu/fuzzing-glibc-libresolv" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8674" }, { "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=31026" }, { "url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0021" }, { "url": "https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-8674" } ], "published": "2026-09-17T17:16:53+00:00", "updated": "2026-09-18T18:17:47+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-86805", "ratings": [ { "source": { "name": "redhat" }, "score": 7, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "cwes": [ 367 ], "description": "A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program.\n\nExploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by \"..\" traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-86805" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-86805" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86805" }, { "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34360" }, { "url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0022" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-86805" } ], "published": "2026-09-22T16:18:06+00:00", "updated": "2026-09-23T04:17:57+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-88647", "ratings": [ { "source": { "name": "redhat" }, "score": 7.4, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], "description": "A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name fallback mechanism and eavesdrop on communications via a crafted certificate.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-88647" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-88647" }, { "url": "https://gist.github.com/lkloliver/f98ec3de1a871fdfc02b70b8b9ba7642" }, { "url": "https://gitlab.com/gnutls/gnutls/-/issues/1802" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88647" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-88647" } ], "published": "2026-10-08T17:17:17+00:00", "updated": "2026-10-08T21:33:42+00:00", "affects": [ { "ref": "pkg:rpm/redhat/gnutls@3.8.10-8.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.8.10-8.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/gnutls@3.8.10-8.el9_8?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-88648", "ratings": [ { "source": { "name": "redhat" }, "score": 7.4, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], "description": "Incomplete X.509 implementation in GnuTLS v3.8.13 allows attackers controlling a subordinate Certificate Authority to bypass cross-domain PKI restrictions and issue unauthorized certificates.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-88648" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-88648" }, { "url": "https://gist.github.com/lkloliver/1f2a97cb8d0b31aa27b6bd0354358d7d" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88648" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-88648" }, { "url": "https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10" }, { "url": "https://www.rfc-editor.org/rfc/rfc5280#section-6.1.4" } ], "published": "2026-10-08T19:20:52+00:00", "updated": "2026-10-08T21:33:42+00:00", "affects": [ { "ref": "pkg:rpm/redhat/gnutls@3.8.10-8.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "3.8.10-8.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/gnutls@3.8.10-8.el9_8?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-88806", "ratings": [ { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "cwes": [ 122 ], "description": "A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key_sym_map.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-88806" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-88806" }, { "url": "https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/309" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88806" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-88806" } ], "published": "2026-09-21T14:17:22+00:00", "updated": "2026-09-22T19:40:05+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libX11-common@1.8.12-1.el9?arch=noarch&distro=redhat-9.8", "versions": [ { "version": "1.8.12-1.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libX11@1.8.12-1.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "1.8.12-1.el9", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libX11-common@1.8.12-1.el9?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libX11@1.8.12-1.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-88807", "ratings": [ { "source": { "name": "redhat" }, "score": 8.3, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 122 ], "description": "A heap overflow in libXrender before 0.9.13 in\u00a0RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-88807" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-88807" }, { "url": "https://gitlab.freedesktop.org/xorg/lib/libxrender/-/merge_requests/19" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88807" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-88807" } ], "published": "2026-09-21T14:17:22+00:00", "updated": "2026-09-22T19:40:05+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libXrender@0.9.10-16.el9_8.1?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "0.9.10-16.el9_8.1", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libXrender@0.9.10-16.el9_8.1?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-89092", "ratings": [ { "source": { "name": "redhat" }, "score": 4.2, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 789 ], "description": "The nscd service in the GNU C Library 2.3.4 onwards may crash due to a \nstack overflow when a malicious DNS server returns too large a response \nfor a DNS query, resulting in degraded DNS resolution for the system.\n\n\n\nExploitation of this bug needs a system that has nscd enabled and using \nan untrusted DNS server for name resolution, with the compromised DNS \nserver being capable of processing records large enough to result in a \nstack overflow in an nscd thread stack.\u00a0 During experimentation, bind 9 \nwas unable to handle large records, but that could change in future or \nwith a different name server.\u00a0 In typical installations, nscd is \nexecuted in an isolated context as its own user without a shell, due to \nwhich any compromise of that service is isolated.\n\n\n\nThere is a remote possibility of nscd cache corruption if an attacker \nmanages to get the stack pointer into a desired point in the heap, \npotentially resulting in other caches in nscd being overwritten with \ncorrupt data through the stack overflow, until the buggy code path \neventually results in a crash.\n\n\n\nFinally, a crash in nscd may result in performance degradation when \nresolving names, but it does not result in a denial of service.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-89092" }, { "url": "http://www.openwall.com/lists/oss-security/2026/09/11/2" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-89092" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89092" }, { "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34624" }, { "url": "https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2026-0016" }, { "url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0016" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-89092" } ], "published": "2026-09-11T02:18:35+00:00", "updated": "2026-09-11T18:17:00+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-89156", "ratings": [ { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "nvd" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 2.9, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "cwes": [ 125 ], "description": "PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-89156" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-89156" }, { "url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48" }, { "url": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-2p8c-ff85-vh9x" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89156" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-89156" } ], "published": "2026-09-11T04:18:03+00:00", "updated": "2026-09-16T19:27:01+00:00", "affects": [ { "ref": "pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8", "versions": [ { "version": "10.40-6.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "10.40-6.el9", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-89157", "ratings": [ { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "nvd" }, "score": 7.4, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H" }, { "source": { "name": "redhat" }, "score": 5.7, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L" } ], "cwes": [ 190 ], "description": "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-89157" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-89157" }, { "url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48" }, { "url": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89157" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-89157" } ], "published": "2026-09-11T04:18:03+00:00", "updated": "2026-09-16T19:25:08+00:00", "affects": [ { "ref": "pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8", "versions": [ { "version": "10.40-6.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "10.40-6.el9", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-89158", "ratings": [ { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "nvd" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L" }, { "source": { "name": "redhat" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L" } ], "cwes": [ 190 ], "description": "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-89158" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-89158" }, { "url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48" }, { "url": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-fmgr-6ggq-9859" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89158" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-89158" } ], "published": "2026-09-11T04:18:03+00:00", "updated": "2026-09-16T19:23:41+00:00", "affects": [ { "ref": "pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8", "versions": [ { "version": "10.40-6.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "10.40-6.el9", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-89160", "ratings": [ { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "nvd" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L" }, { "source": { "name": "redhat" }, "score": 3.7, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "cwes": [ 125 ], "description": "PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-89160" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-89160" }, { "url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48" }, { "url": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-9qww-pwc4-77qq" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89160" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-89160" } ], "published": "2026-09-11T04:18:04+00:00", "updated": "2026-09-16T19:15:29+00:00", "affects": [ { "ref": "pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8", "versions": [ { "version": "10.40-6.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "10.40-6.el9", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-89161", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "nvd" }, "score": 7.8, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": { "name": "redhat" }, "score": 7.4, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 590 ], "description": "In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-89161" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-89161" }, { "url": "https://github.com/PCRE2Project/pcre2/commit/1dcd0cf42a6a7cb62cc9a7c024196733abcfda95%20%28pcre2-10.48-RC1%29" }, { "url": "https://github.com/PCRE2Project/pcre2/pull/937" }, { "url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89161" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-89161" } ], "published": "2026-09-11T04:18:04+00:00", "updated": "2026-09-16T19:10:47+00:00", "affects": [ { "ref": "pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8", "versions": [ { "version": "10.40-6.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "10.40-6.el9", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-8924", "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "high" }, { "source": { "name": "julia" }, "score": 9.1, "severity": "critical", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "photon" }, "severity": "critical" }, { "source": { "name": "redhat" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N" }, { "source": { "name": "rocky" }, "severity": "high" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 201 ], "description": "A flaw in curl\u2019s cookie parsing logic allows a malicious HTTP server to set\n\"super cookies\" that bypass the Public Suffix List check. This enables an\nattacker-controlled origin to inject cookies that curl subsequently scopes and\ntransmits to unrelated third-party domains.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-8924" }, { "url": "https://access.redhat.com/errata/RHSA-2026:69125" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-8924" }, { "url": "https://bugzilla.redhat.com/2496759" }, { "url": "https://bugzilla.redhat.com/2496760" }, { "url": "https://bugzilla.redhat.com/2496764" }, { "url": "https://bugzilla.redhat.com/2496765" }, { "url": "https://bugzilla.redhat.com/2496767" }, { "url": "https://bugzilla.redhat.com/2496771" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496759" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496760" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496764" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496765" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496767" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496771" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://curl.se/L7HzKXisfJ/CVE-2026-8924.md" }, { "url": "https://curl.se/docs/CVE-2026-8924.html" }, { "url": "https://curl.se/docs/CVE-2026-8924.json" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11856" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8458" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8924" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8926" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8932" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9079" }, { "url": "https://errata.almalinux.org/10/ALSA-2026-69125.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:69125" }, { "url": "https://github.com/advisories/GHSA-hm6c-rc5h-32m9" }, { "url": "https://hackerone.com/reports/3733905" }, { "url": "https://linux.oracle.com/cve/CVE-2026-8924.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-69125.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8924" }, { "url": "https://ubuntu.com/security/notices/USN-8487-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-8924" } ], "published": "2026-07-03T07:16:24+00:00", "updated": "2026-09-15T07:16:32+00:00", "affects": [ { "ref": "pkg:rpm/redhat/curl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "7.76.1-40.el9_8.7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libcurl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "7.76.1-40.el9_8.7", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/curl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libcurl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8" } ] }, { "id": "CVE-2026-8932", "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "high" }, { "source": { "name": "julia" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 7.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "source": { "name": "rocky" }, "severity": "high" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 305 ], "description": "libcurl would reuse a previously created connection even when some mTLS config\nrelated option had been changed that should have prohibited reuse.\n\nlibcurl keeps previously used connections in a connection pool for subsequent\ntransfers to reuse if one of them matches the setup. However, some TLS\nsettings related to client certificates were left out from the configuration\nmatch checks, making them match too easily. In particular options related to\nthe private key.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-8932" }, { "url": "https://access.redhat.com/errata/RHSA-2026:69125" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-8932" }, { "url": "https://bugzilla.redhat.com/2496759" }, { "url": "https://bugzilla.redhat.com/2496760" }, { "url": "https://bugzilla.redhat.com/2496764" }, { "url": "https://bugzilla.redhat.com/2496765" }, { "url": "https://bugzilla.redhat.com/2496767" }, { "url": "https://bugzilla.redhat.com/2496771" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496759" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496760" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496764" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496765" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496767" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496771" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://curl.se/L7HzKXisfJ/CVE-2026-8932.md" }, { "url": "https://curl.se/docs/CVE-2026-8932.html" }, { "url": "https://curl.se/docs/CVE-2026-8932.json" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11856" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8458" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8924" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8926" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8932" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9079" }, { "url": "https://errata.almalinux.org/10/ALSA-2026-69125.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:69125" }, { "url": "https://github.com/advisories/GHSA-m7xm-hf59-w6rj" }, { "url": "https://hackerone.com/reports/3733910" }, { "url": "https://linux.oracle.com/cve/CVE-2026-8932.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-69125.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8932" }, { "url": "https://ubuntu.com/security/notices/USN-8670-1" }, { "url": "https://ubuntu.com/security/notices/USN-8670-2" }, { "url": "https://ubuntu.com/security/notices/USN-8670-3" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-8932" } ], "published": "2026-07-03T07:16:25+00:00", "updated": "2026-09-15T07:16:33+00:00", "affects": [ { "ref": "pkg:rpm/redhat/curl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "7.76.1-40.el9_8.7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libcurl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "7.76.1-40.el9_8.7", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/curl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libcurl@7.76.1-40.el9_8.7?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-90781", "ratings": [ { "source": { "name": "redhat" }, "score": 6.1, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H" } ], "cwes": [ 193 ], "description": "alsa-lib through 1.2.16.1 contains a stack buffer overflow in the __snd_ctl_ascii_elem_id_parse() function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long control-element identifier string through saved state files or command-line arguments to overwrite adjacent stack memory and crash the calling process.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-90781" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-90781" }, { "url": "https://github.com/alsa-project/alsa-lib" }, { "url": "https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/control/ctlparse.c#L216-L241" }, { "url": "https://github.com/alsa-project/alsa-lib/commit/f84cd4ced7b36fddb8e4ee24404cf7c091d27020" }, { "url": "https://lore.kernel.org/alsa-devel/CACBQ=P2FhO3M6dkv3cWuKb6Qhs92ouV+FJ3SJZ_PVBSSdJWRAQ@mail.gmail.com/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90781" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-90781" }, { "url": "https://www.vulncheck.com/advisories/alsa-lib-through-1.2.16.1-off-by-one-stack-buffer-overflow-in-snd-ctl-ascii-elem-id-parse" } ], "published": "2026-09-13T13:16:29+00:00", "updated": "2026-09-24T20:47:31+00:00", "affects": [ { "ref": "pkg:rpm/redhat/alsa-lib@1.2.15.3-1.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "1.2.15.3-1.el9", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/alsa-lib@1.2.15.3-1.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-93541", "ratings": [ { "source": { "name": "redhat" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "cwes": [ 125 ], "description": "An out-of-bounds read in libXi's XQueryDeviceState() in libXi before 1.8.4 could be used by a", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-93541" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-93541" }, { "url": "https://gitlab.freedesktop.org/xorg/lib/libxi/-/merge_requests/23/diffs?commit_id=7b6fffd13fd3914e0b39f3a4f131913da7f066e7" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93541" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-93541" } ], "published": "2026-09-24T16:17:26+00:00", "updated": "2026-09-24T21:00:46+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libXi@1.7.10-8.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "1.7.10-8.el9", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libXi@1.7.10-8.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-93542", "ratings": [ { "source": { "name": "redhat" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "cwes": [ 125 ], "description": "An out-of-bounds read in libXi's XI2 class parsing via size_classes() and copy_classes() in libXi before 1.8.4 could be used by malicous servers to crash the X client.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-93542" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-93542" }, { "url": "https://gitlab.freedesktop.org/xorg/lib/libxi/-/merge_requests/23/diffs?commit_id=f499944ad595b9bd7e7571c810842244caf150aa" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93542" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-93542" } ], "published": "2026-09-24T17:17:10+00:00", "updated": "2026-09-24T21:00:46+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libXi@1.7.10-8.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "1.7.10-8.el9", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libXi@1.7.10-8.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-93543", "ratings": [ { "source": { "name": "redhat" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "cwes": [ 125 ], "description": "An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-93543" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-93543" }, { "url": "https://gitlab.freedesktop.org/xorg/lib/libxi/-/merge_requests/23/diffs?commit_id=e2089ab748828273f916bbffd4e65b506aa50fdc" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93543" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-93543" } ], "published": "2026-09-24T17:17:10+00:00", "updated": "2026-09-24T21:00:46+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libXi@1.7.10-8.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "1.7.10-8.el9", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libXi@1.7.10-8.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-93544", "ratings": [ { "source": { "name": "redhat" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "cwes": [ 125 ], "description": "An out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing in libXi before 1.8.4 can be used by a malicious X server to crash an attached X client.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-93544" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-93544" }, { "url": "https://gitlab.freedesktop.org/xorg/lib/libxi/-/merge_requests/23/diffs?commit_id=a88a341135b79f6ed450f481e4a5d6ba502382af" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93544" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-93544" } ], "published": "2026-09-24T17:17:10+00:00", "updated": "2026-09-24T21:00:46+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libXi@1.7.10-8.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "1.7.10-8.el9", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libXi@1.7.10-8.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-93545", "ratings": [ { "source": { "name": "redhat" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "cwes": [ 125 ], "description": "An out-of-bounds read in libXi's XListInputDevices() in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-93545" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-93545" }, { "url": "https://gitlab.freedesktop.org/xorg/lib/libxi/-/merge_requests/23/diffs?commit_id=234ce17d95c42d75f7f7fdb2bf7a24875451bc0a" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93545" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-93545" } ], "published": "2026-09-24T17:17:10+00:00", "updated": "2026-09-24T21:00:46+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libXi@1.7.10-8.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "1.7.10-8.el9", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libXi@1.7.10-8.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-93990", "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "high" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "source": { "name": "rocky" }, "severity": "high" } ], "cwes": [ 176 ], "description": "Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds.", "recommendation": "Upgrade expat to version 2.5.0-6.el9_8.5", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-93990" }, { "url": "https://access.redhat.com/errata/RHSA-2026:72663" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-93990" }, { "url": "https://blog.hartwork.org/posts/expat-2-8-5-released/" }, { "url": "https://bugzilla.redhat.com/2538967" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517901" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2538967" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-66046" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93990" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-72663.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:72663" }, { "url": "https://github.com/libexpat/libexpat" }, { "url": "https://github.com/libexpat/libexpat/commit/ff6e1d7e750bbe245178f51a47a965dc8342861a" }, { "url": "https://github.com/libexpat/libexpat/pull/1282" }, { "url": "https://github.com/libexpat/libexpat/releases/tag/R_2_8_5" }, { "url": "https://linux.oracle.com/cve/CVE-2026-93990.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-74001.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93990" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-93990" }, { "url": "https://www.vulncheck.com/advisories/expat-through-2.8.4-malformed-utf-16-acceptance-via-unchecked-surrogate" } ], "published": "2026-09-19T23:17:10+00:00", "updated": "2026-09-28T17:17:53+00:00", "affects": [ { "ref": "pkg:rpm/redhat/expat@2.5.0-6.el9_8.3?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.5.0-6.el9_8.3", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/expat@2.5.0-6.el9_8.3?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-94281", "ratings": [ { "source": { "name": "redhat" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "cwes": [ 125 ], "description": "An out-of-bounds read in libXi's XListInputDevices() class parsing in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-94281" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-94281" }, { "url": "https://gitlab.freedesktop.org/xorg/lib/libxi/-/merge_requests/23/diffs?commit_id=605f419d013153bf9e026cd100752ffbe930f3c1" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94281" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-94281" } ], "published": "2026-09-24T17:17:16+00:00", "updated": "2026-09-24T21:00:46+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libXi@1.7.10-8.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "1.7.10-8.el9", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libXi@1.7.10-8.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-94283", "ratings": [ { "source": { "name": "redhat" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "cwes": [ 125 ], "description": "An out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-94283" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-94283" }, { "url": "https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/310/diffs?commit_id=42d0303f243002a9856c76060569a61893c670dd" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94283" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-94283" } ], "published": "2026-09-28T09:17:08+00:00", "updated": "2026-09-30T13:17:26+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libX11-common@1.8.12-1.el9?arch=noarch&distro=redhat-9.8", "versions": [ { "version": "1.8.12-1.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libX11@1.8.12-1.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "1.8.12-1.el9", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libX11-common@1.8.12-1.el9?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libX11@1.8.12-1.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-94284", "ratings": [ { "source": { "name": "redhat" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "cwes": [ 125 ], "description": "An out-of-bounds read vulnerability in libX11's XIM trigger-key registration parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-94284" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-94284" }, { "url": "https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/310/diffs?commit_id=1b7904002d212eed40949ccf4e8e7156f9fec0e2" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94284" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-94284" } ], "published": "2026-09-28T09:17:08+00:00", "updated": "2026-09-30T13:17:26+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libX11-common@1.8.12-1.el9?arch=noarch&distro=redhat-9.8", "versions": [ { "version": "1.8.12-1.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libX11@1.8.12-1.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "1.8.12-1.el9", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libX11-common@1.8.12-1.el9?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libX11@1.8.12-1.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-94285", "ratings": [ { "source": { "name": "redhat" }, "score": 5.1, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L" } ], "cwes": [ 125 ], "description": "An out-of-bounds read in libX11's byte-oriented codeset parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-94285" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-94285" }, { "url": "https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/310/diffs?commit_id=980868483446f24f9658d26aa5bfa42f3da6dd3a" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94285" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-94285" } ], "published": "2026-09-28T09:17:08+00:00", "updated": "2026-09-30T13:17:26+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libX11-common@1.8.12-1.el9?arch=noarch&distro=redhat-9.8", "versions": [ { "version": "1.8.12-1.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libX11@1.8.12-1.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "1.8.12-1.el9", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libX11-common@1.8.12-1.el9?arch=noarch&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libX11@1.8.12-1.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-94286", "ratings": [ { "source": { "name": "redhat" }, "score": 7.1, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H" } ], "cwes": [ 126 ], "description": "An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-94286" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-94286" }, { "url": "https://gitlab.freedesktop.org/xorg/lib/libxtst/-/merge_requests/10/diffs?commit_id=16023c86070e6af9407330deea3938fcef75815b" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94286" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-94286" } ], "published": "2026-09-28T09:17:08+00:00", "updated": "2026-09-30T13:17:26+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libXtst@1.2.3-16.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "1.2.3-16.el9", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libXtst@1.2.3-16.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-95512", "ratings": [ { "source": { "name": "redhat" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 400 ], "description": "A flaw was found in FreeType, specifically within its CID font loader. A remote attacker could exploit this vulnerability by tricking a user into opening content that embeds or references a specially crafted CID-keyed font. This crafted font can cause repeated allocations and decryptions of subroutine data across multiple font dictionaries, leading to excessive memory and CPU consumption. This can result in a denial of service (DoS) for the application or service processing the font, potentially causing it to hang or terminate.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-95512" }, { "url": "https://access.redhat.com/errata/RHSA-2026:74952" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-95512" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2462295" }, { "url": "https://gitlab.freedesktop.org/freetype/freetype/-/commit/f3ca71c9900fe860849b3163a6e2c1e765b291d9" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95512" }, { "url": "https://ubuntu.com/security/notices/USN-8881-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-95512" } ], "published": "2026-10-02T09:16:45+00:00", "updated": "2026-10-06T03:17:09+00:00", "affects": [ { "ref": "pkg:rpm/redhat/freetype@2.10.4-10.el9_5?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.10.4-10.el9_5", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/freetype@2.10.4-10.el9_5?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-95619", "ratings": [ { "source": { "name": "redhat" }, "score": 7.7, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 190 ], "description": "A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-95619" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58503" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67275" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-95619" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2537811" }, { "url": "https://gcc.gnu.org/pipermail/gcc-patches/2026-September/732381.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95619" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-95619" } ], "published": "2026-09-22T13:17:13+00:00", "updated": "2026-09-22T19:37:36+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libgcc@11.5.0-14.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "11.5.0-14.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libstdc%2B%2B@11.5.0-14.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "11.5.0-14.el9", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libgcc@11.5.0-14.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/libstdc%2B%2B@11.5.0-14.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/libgcc@11.5.0-14.el9?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/libgcc@11.5.0-14.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-95818", "ratings": [ { "source": { "name": "redhat" }, "score": 7, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "cwes": [ 121 ], "description": "A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs.\n\nWhen such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-95818" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-95818" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95818" }, { "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34360" }, { "url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0023" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-95818" } ], "published": "2026-09-22T17:17:32+00:00", "updated": "2026-09-22T19:56:19+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-96674", "ratings": [ { "source": { "name": "redhat" }, "score": 4.4, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L" } ], "cwes": [ 190 ], "description": "alsa-lib through 1.2.16.1 computes combined topology element size using 32-bit arithmetic in src/topology/ctl.c, allowing integer overflow that defeats bounds checks. Attackers can supply crafted topology files that wrap size calculations, causing the decoder to read beyond the topology buffer and potentially leak sensitive data or crash the application.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-96674" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-96674" }, { "url": "https://github.com/alsa-project/alsa-lib" }, { "url": "https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/topology/ctl.c#L1316-L1326" }, { "url": "https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/topology/ctl.c#L1420-L1430" }, { "url": "https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/topology/ctl.c#L1511-L1521" }, { "url": "https://github.com/alsa-project/alsa-lib/pull/527" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96674" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-96674" }, { "url": "https://www.vulncheck.com/advisories/alsa-lib-through-1.2.16.1-integer-overflow-via-topology-file" } ], "published": "2026-09-23T16:16:50+00:00", "updated": "2026-09-24T21:08:55+00:00", "affects": [ { "ref": "pkg:rpm/redhat/alsa-lib@1.2.15.3-1.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "1.2.15.3-1.el9", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/alsa-lib@1.2.15.3-1.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-96675", "ratings": [ { "source": { "name": "redhat" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 129 ], "description": "alsa-lib through 1.2.16.1 contains a denial of service vulnerability in the multi PCM plugin that fails to validate sparse binding indices before array access. Attackers can supply a malicious ALSA configuration file with sparse bindings to trigger an out-of-bounds array read and assertion failure, causing the application to abort.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-96675" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-96675" }, { "url": "https://github.com/alsa-project/alsa-lib" }, { "url": "https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/pcm/pcm_multi.c#L1122-L1131" }, { "url": "https://github.com/alsa-project/alsa-lib/pull/527" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96675" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-96675" }, { "url": "https://www.vulncheck.com/advisories/alsa-lib-through-1.2.16.1-denial-of-service-via-pcm-multi" } ], "published": "2026-09-23T16:16:50+00:00", "updated": "2026-09-24T21:08:55+00:00", "affects": [ { "ref": "pkg:rpm/redhat/alsa-lib@1.2.15.3-1.el9?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "1.2.15.3-1.el9", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/alsa-lib@1.2.15.3-1.el9?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-97032", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [ { "source": { "name": "redhat" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "description": "HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.", "recommendation": "Upgrade golang.org/x/net to version 0.60.0", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-97032" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-97032" }, { "url": "https://go.dev/cl/847188" }, { "url": "https://go.dev/cl/847313" }, { "url": "https://go.dev/issue/81867" }, { "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI" }, { "url": "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97032" }, { "url": "https://pkg.go.dev/vuln/GO-2026-6617" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-97032" } ], "published": "2026-10-08T23:17:06+00:00", "updated": "2026-10-08T23:17:06+00:00", "affects": [ { "ref": "pkg:golang/golang.org/x/net@v0.58.0", "versions": [ { "version": "v0.58.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/net@v0.58.0", "versions": [ { "version": "v0.58.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/net@v0.58.0", "versions": [ { "version": "v0.58.0", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.25.11", "versions": [ { "version": "v1.25.11", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:golang/golang.org/x/net@v0.58.0" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:golang/stdlib@v1.25.11" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:golang/golang.org/x/net@v0.58.0" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-97399", "ratings": [ { "source": { "name": "redhat" }, "score": 3.7, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "cwes": [ 126 ], "description": "The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-97399" }, { "url": "http://www.openwall.com/lists/oss-security/2026/09/28/7" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-97399" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97399" }, { "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34683" }, { "url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0024" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-97399" } ], "published": "2026-09-28T16:17:18+00:00", "updated": "2026-09-29T21:36:39+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8", "versions": [ { "version": "2.34-275.el9_8", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/glibc-common@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:rpm/redhat/glibc@2.34-275.el9_8?arch=x86_64&distro=redhat-9.8" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "GO-2026-5932", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [], "description": "The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.\n\nIf you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.", "advisories": [ { "url": "https://go.dev/issue/44226" }, { "url": "https://pkg.go.dev/vuln/GO-2026-5932" } ], "affects": [ { "ref": "pkg:golang/golang.org/x/crypto@v0.56.0", "versions": [ { "version": "v0.56.0", "status": "affected" } ] }, { "ref": "pkg:golang/golang.org/x/crypto@v0.56.0", "versions": [ { "version": "v0.56.0", "status": "affected" } ] }, { "ref": "urn:cdx:06012f1a-cf6c-4ea6-9bd6-95b2cb9f2555/1#pkg:golang/golang.org/x/crypto@v0.56.0" }, { "ref": "urn:cdx:09e5e5fe-bbbb-4cbd-8c3d-bedd99cf83bf/1#pkg:golang/golang.org/x/crypto@v0.56.0" } ] }, { "id": "CVE-2026-33818", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "bitnami" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "rocky" }, "severity": "high" } ], "cwes": [ 400 ], "description": "Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.", "recommendation": "Upgrade stdlib to version 1.25.13, 1.26.6, 1.27.0-rc.3", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-33818" }, { "url": "https://access.redhat.com/errata/RHSA-2026:70641" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-33818" }, { "url": "https://bugzilla.redhat.com/2515815" }, { "url": "https://bugzilla.redhat.com/2515820" }, { "url": "https://bugzilla.redhat.com/2515827" }, { "url": "https://bugzilla.redhat.com/2515838" }, { "url": "https://bugzilla.redhat.com/2515839" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2402034" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515815" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515820" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515827" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515838" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515839" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-70641.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:70641" }, { "url": "https://go.dev/cl/814980" }, { "url": "https://go.dev/issue/80405" }, { "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI" }, { "url": "https://linux.oracle.com/cve/CVE-2026-33818.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-70641.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33818" }, { "url": "https://pkg.go.dev/vuln/GO-2026-5972" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-33818" } ], "published": "2026-08-13T22:17:19+00:00", "updated": "2026-09-03T16:37:52+00:00", "affects": [ { "ref": "pkg:golang/stdlib@v1.25.11", "versions": [ { "version": "v1.25.11", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.25.11", "versions": [ { "version": "v1.25.11", "status": "affected" } ] }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:golang/stdlib@v1.25.11" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-39821", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "critical" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 8.2, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N" }, { "source": { "name": "rocky" }, "severity": "high" }, { "source": { "name": "ubuntu" }, "severity": "high" } ], "cwes": [ 1289 ], "description": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".", "recommendation": "Upgrade stdlib to version 1.25.13, 1.26.6, 1.27.0-rc.3", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-39821" }, { "url": "https://access.redhat.com/errata/RHSA-2026:23262" }, { "url": "https://access.redhat.com/errata/RHSA-2026:23264" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26546" }, { "url": "https://access.redhat.com/errata/RHSA-2026:26547" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30650" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30651" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30853" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30854" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30855" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33155" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33160" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33163" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33173" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33183" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33524" }, { "url": "https://access.redhat.com/errata/RHSA-2026:33531" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34342" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34357" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34359" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34364" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34789" }, { "url": "https://access.redhat.com/errata/RHSA-2026:35826" }, { "url": "https://access.redhat.com/errata/RHSA-2026:35827" }, { "url": "https://access.redhat.com/errata/RHSA-2026:35828" }, { "url": "https://access.redhat.com/errata/RHSA-2026:35829" }, { "url": "https://access.redhat.com/errata/RHSA-2026:35830" }, { "url": "https://access.redhat.com/errata/RHSA-2026:35831" }, { "url": "https://access.redhat.com/errata/RHSA-2026:35993" }, { "url": "https://access.redhat.com/errata/RHSA-2026:35994" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36105" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36167" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36207" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36648" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36651" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36796" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36797" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36808" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36820" }, { "url": "https://access.redhat.com/errata/RHSA-2026:36883" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37387" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37435" }, { "url": "https://access.redhat.com/errata/RHSA-2026:37436" }, { "url": "https://access.redhat.com/errata/RHSA-2026:38995" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39005" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39573" }, { "url": "https://access.redhat.com/errata/RHSA-2026:39879" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40118" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40262" }, { "url": "https://access.redhat.com/errata/RHSA-2026:40945" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41019" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41030" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41031" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41036" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41055" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41066" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41928" }, { "url": "https://access.redhat.com/errata/RHSA-2026:41930" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42043" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42047" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42048" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42049" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42050" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42051" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42078" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42079" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42080" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42082" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42132" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42142" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42146" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42150" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42151" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42240" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42644" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42796" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42852" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43038" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43052" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43692" }, { "url": "https://access.redhat.com/errata/RHSA-2026:44622" }, { "url": "https://access.redhat.com/errata/RHSA-2026:44624" }, { "url": "https://access.redhat.com/errata/RHSA-2026:46395" }, { "url": "https://access.redhat.com/errata/RHSA-2026:47149" }, { "url": "https://access.redhat.com/errata/RHSA-2026:47735" }, { "url": "https://access.redhat.com/errata/RHSA-2026:47737" }, { "url": "https://access.redhat.com/errata/RHSA-2026:47952" }, { "url": "https://access.redhat.com/errata/RHSA-2026:49702" }, { "url": "https://access.redhat.com/errata/RHSA-2026:49712" }, { "url": "https://access.redhat.com/errata/RHSA-2026:50300" }, { "url": "https://access.redhat.com/errata/RHSA-2026:50843" }, { "url": "https://access.redhat.com/errata/RHSA-2026:51033" }, { "url": "https://access.redhat.com/errata/RHSA-2026:51112" }, { "url": "https://access.redhat.com/errata/RHSA-2026:51187" }, { "url": "https://access.redhat.com/errata/RHSA-2026:51194" }, { "url": "https://access.redhat.com/errata/RHSA-2026:51341" }, { "url": "https://access.redhat.com/errata/RHSA-2026:52826" }, { "url": "https://access.redhat.com/errata/RHSA-2026:53374" }, { "url": "https://access.redhat.com/errata/RHSA-2026:53412" }, { "url": "https://access.redhat.com/errata/RHSA-2026:53413" }, { "url": "https://access.redhat.com/errata/RHSA-2026:53415" }, { "url": "https://access.redhat.com/errata/RHSA-2026:53530" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54191" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54274" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54283" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54284" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54285" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54286" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54287" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54395" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54401" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54435" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54441" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54531" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54580" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54757" }, { "url": "https://access.redhat.com/errata/RHSA-2026:56143" }, { "url": "https://access.redhat.com/errata/RHSA-2026:56223" }, { "url": "https://access.redhat.com/errata/RHSA-2026:56340" }, { "url": "https://access.redhat.com/errata/RHSA-2026:56431" }, { "url": "https://access.redhat.com/errata/RHSA-2026:57194" }, { "url": "https://access.redhat.com/errata/RHSA-2026:57541" }, { "url": "https://access.redhat.com/errata/RHSA-2026:57649" }, { "url": "https://access.redhat.com/errata/RHSA-2026:57845" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59546" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59549" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59562" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60315" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60354" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60387" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60520" }, { "url": "https://access.redhat.com/errata/RHSA-2026:61245" }, { "url": "https://access.redhat.com/errata/RHSA-2026:61253" }, { "url": "https://access.redhat.com/errata/RHSA-2026:62549" }, { "url": "https://access.redhat.com/errata/RHSA-2026:63134" }, { "url": "https://access.redhat.com/errata/RHSA-2026:65126" }, { "url": "https://access.redhat.com/errata/RHSA-2026:65153" }, { "url": "https://access.redhat.com/errata/RHSA-2026:65359" }, { "url": "https://access.redhat.com/errata/RHSA-2026:65534" }, { "url": "https://access.redhat.com/errata/RHSA-2026:65851" }, { "url": "https://access.redhat.com/errata/RHSA-2026:65886" }, { "url": "https://access.redhat.com/errata/RHSA-2026:66016" }, { "url": "https://access.redhat.com/errata/RHSA-2026:66022" }, { "url": "https://access.redhat.com/errata/RHSA-2026:66350" }, { "url": "https://access.redhat.com/errata/RHSA-2026:66432" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67149" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67159" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67160" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67287" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67319" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67517" }, { "url": "https://access.redhat.com/errata/RHSA-2026:68504" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-39821" }, { "url": "https://bugzilla.redhat.com/2467809" }, { "url": "https://bugzilla.redhat.com/2467820" }, { "url": "https://bugzilla.redhat.com/2480756" }, { "url": "https://bugzilla.redhat.com/2484204" }, { "url": "https://bugzilla.redhat.com/2515815" }, { "url": "https://bugzilla.redhat.com/2515820" }, { "url": "https://bugzilla.redhat.com/2515827" }, { "url": "https://bugzilla.redhat.com/2515838" }, { "url": "https://bugzilla.redhat.com/2515839" }, { "url": "https://bugzilla.redhat.com/2515840" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456333" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456339" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467809" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467820" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467822" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480756" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484204" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515815" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515820" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515827" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515838" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515839" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515840" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-65153.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:65886" }, { "url": "https://go.dev/cl/767220" }, { "url": "https://go.dev/issue/78760" }, { "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI" }, { "url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8" }, { "url": "https://linux.oracle.com/cve/CVE-2026-39821.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-66432-0.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821" }, { "url": "https://pkg.go.dev/vuln/GO-2026-5026" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39821.json" }, { "url": "https://ubuntu.com/security/notices/USN-8416-1" }, { "url": "https://ubuntu.com/security/notices/USN-8883-1" }, { "url": "https://ubuntu.com/security/notices/USN-8900-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-39821" } ], "published": "2026-05-22T16:16:20+00:00", "updated": "2026-09-17T12:18:05+00:00", "affects": [ { "ref": "pkg:golang/stdlib@v1.25.11", "versions": [ { "version": "v1.25.11", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.25.11", "versions": [ { "version": "v1.25.11", "status": "affected" } ] }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:golang/stdlib@v1.25.11" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-39822", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "high" }, { "source": { "name": "bitnami" }, "score": 7.8, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 7.8, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": { "name": "rocky" }, "severity": "high" } ], "cwes": [ 61 ], "description": "On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open(\"symlink/\")' will open \"symlink\" even when \"symlink\" is a symbolic link pointing outside of the root.", "recommendation": "Upgrade stdlib to version 1.25.12, 1.26.5, 1.27.0-rc.2", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-39822" }, { "url": "https://access.redhat.com/errata/RHSA-2026:38878" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-39822" }, { "url": "https://bugzilla.redhat.com/2498152" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498152" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39822" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-38878.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:38878" }, { "url": "https://go.dev/cl/797880" }, { "url": "https://go.dev/issue/79005" }, { "url": "https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc" }, { "url": "https://linux.oracle.com/cve/CVE-2026-39822.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-38995.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39822" }, { "url": "https://pkg.go.dev/vuln/GO-2026-4970" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-39822" } ], "published": "2026-07-08T17:17:21+00:00", "updated": "2026-09-17T17:10:20+00:00", "affects": [ { "ref": "pkg:golang/stdlib@v1.25.11", "versions": [ { "version": "v1.25.11", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.25.11", "versions": [ { "version": "v1.25.11", "status": "affected" } ] }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:golang/stdlib@v1.25.11" } ] }, { "id": "CVE-2026-42505", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "bitnami" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "cwes": [ 201 ], "description": "Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.", "recommendation": "Upgrade stdlib to version 1.25.12, 1.26.5, 1.27.0-rc.2", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-42505" }, { "url": "https://access.redhat.com/errata/RHSA-2026:66364" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-42505" }, { "url": "https://bugzilla.redhat.com/2515815" }, { "url": "https://bugzilla.redhat.com/2515820" }, { "url": "https://bugzilla.redhat.com/2515839" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-66364.html" }, { "url": "https://go.dev/cl/775960" }, { "url": "https://go.dev/issue/79282" }, { "url": "https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42505" }, { "url": "https://pkg.go.dev/vuln/GO-2026-5856" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-42505" } ], "published": "2026-07-08T17:17:21+00:00", "updated": "2026-09-16T20:14:44+00:00", "affects": [ { "ref": "pkg:golang/stdlib@v1.25.11", "versions": [ { "version": "v1.25.11", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.25.11", "versions": [ { "version": "v1.25.11", "status": "affected" } ] }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:golang/stdlib@v1.25.11" } ] }, { "id": "CVE-2026-56853", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "bitnami" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "rocky" }, "severity": "high" } ], "cwes": [ 770 ], "description": "When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.", "recommendation": "Upgrade stdlib to version 1.25.13, 1.26.6, 1.27.0-rc.3", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-56853" }, { "url": "https://access.redhat.com/errata/RHSA-2026:70641" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-56853" }, { "url": "https://bugzilla.redhat.com/2515815" }, { "url": "https://bugzilla.redhat.com/2515820" }, { "url": "https://bugzilla.redhat.com/2515827" }, { "url": "https://bugzilla.redhat.com/2515838" }, { "url": "https://bugzilla.redhat.com/2515839" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2402034" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515815" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515820" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515827" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515838" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515839" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-70641.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:70641" }, { "url": "https://go.dev/cl/795540" }, { "url": "https://go.dev/issue/80205" }, { "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI" }, { "url": "https://linux.oracle.com/cve/CVE-2026-56853.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-70641.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56853" }, { "url": "https://pkg.go.dev/vuln/GO-2026-6089" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-56853" } ], "published": "2026-08-13T22:17:22+00:00", "updated": "2026-09-03T16:37:52+00:00", "affects": [ { "ref": "pkg:golang/stdlib@v1.25.11", "versions": [ { "version": "v1.25.11", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.25.11", "versions": [ { "version": "v1.25.11", "status": "affected" } ] }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:golang/stdlib@v1.25.11" } ] }, { "id": "CVE-2026-56857", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [], "description": "On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).", "recommendation": "Upgrade stdlib to version 1.26.9, 1.27.2", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-56857" }, { "url": "https://go.dev/cl/847305" }, { "url": "https://go.dev/issue/81739" }, { "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI" }, { "url": "https://pkg.go.dev/vuln/GO-2026-6604" } ], "published": "2026-10-08T23:17:01+00:00", "updated": "2026-10-08T23:17:01+00:00", "affects": [ { "ref": "pkg:golang/stdlib@v1.25.11", "versions": [ { "version": "v1.25.11", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.25.11", "versions": [ { "version": "v1.25.11", "status": "affected" } ] }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:golang/stdlib@v1.25.11" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-56858", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "bitnami" }, "score": 6.1, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "photon" }, "severity": "critical" }, { "source": { "name": "redhat" }, "score": 8.1, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" }, { "source": { "name": "rocky" }, "severity": "high" } ], "cwes": [ 79 ], "description": "Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.", "recommendation": "Upgrade stdlib to version 1.25.13, 1.26.6, 1.27.0-rc.3", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-56858" }, { "url": "https://access.redhat.com/errata/RHSA-2026:70641" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-56858" }, { "url": "https://bugzilla.redhat.com/2515815" }, { "url": "https://bugzilla.redhat.com/2515820" }, { "url": "https://bugzilla.redhat.com/2515827" }, { "url": "https://bugzilla.redhat.com/2515838" }, { "url": "https://bugzilla.redhat.com/2515839" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2402034" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515815" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515820" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515827" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515838" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515839" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-70641.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:70641" }, { "url": "https://go.dev/cl/807100" }, { "url": "https://go.dev/issue/80435" }, { "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI" }, { "url": "https://linux.oracle.com/cve/CVE-2026-56858.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-70641.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56858" }, { "url": "https://pkg.go.dev/vuln/GO-2026-6091" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-56858" } ], "published": "2026-08-13T22:17:22+00:00", "updated": "2026-09-03T16:37:52+00:00", "affects": [ { "ref": "pkg:golang/stdlib@v1.25.11", "versions": [ { "version": "v1.25.11", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.25.11", "versions": [ { "version": "v1.25.11", "status": "affected" } ] }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:golang/stdlib@v1.25.11" } ] }, { "id": "CVE-2026-56859", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "bitnami" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "rocky" }, "severity": "high" } ], "cwes": [ 770 ], "description": "Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.", "recommendation": "Upgrade stdlib to version 1.25.13, 1.26.6, 1.27.0-rc.3", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-56859" }, { "url": "https://access.redhat.com/errata/RHSA-2026:69961" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-56859" }, { "url": "https://bugzilla.redhat.com/2480684" }, { "url": "https://bugzilla.redhat.com/2508234" }, { "url": "https://bugzilla.redhat.com/2515815" }, { "url": "https://bugzilla.redhat.com/2515820" }, { "url": "https://bugzilla.redhat.com/2515827" }, { "url": "https://bugzilla.redhat.com/2515838" }, { "url": "https://bugzilla.redhat.com/2515839" }, { "url": "https://bugzilla.redhat.com/2515840" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480684" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508234" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515815" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515820" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515827" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515838" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515839" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515840" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2518147" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17106" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19730" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39830" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-69961.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:69961" }, { "url": "https://go.dev/cl/803320" }, { "url": "https://go.dev/issue/80481" }, { "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI" }, { "url": "https://linux.oracle.com/cve/CVE-2026-56859.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-70201.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56859" }, { "url": "https://pkg.go.dev/vuln/GO-2026-6088" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-56859" } ], "published": "2026-08-13T22:17:22+00:00", "updated": "2026-09-03T16:37:52+00:00", "affects": [ { "ref": "pkg:golang/stdlib@v1.25.11", "versions": [ { "version": "v1.25.11", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.25.11", "versions": [ { "version": "v1.25.11", "status": "affected" } ] }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:golang/stdlib@v1.25.11" } ] }, { "id": "CVE-2026-56860", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "bitnami" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "rocky" }, "severity": "high" } ], "cwes": [ 407 ], "description": "Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.", "recommendation": "Upgrade stdlib to version 1.25.13, 1.26.6, 1.27.0-rc.3", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-56860" }, { "url": "https://access.redhat.com/errata/RHSA-2026:70641" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-56860" }, { "url": "https://bugzilla.redhat.com/2515815" }, { "url": "https://bugzilla.redhat.com/2515820" }, { "url": "https://bugzilla.redhat.com/2515827" }, { "url": "https://bugzilla.redhat.com/2515838" }, { "url": "https://bugzilla.redhat.com/2515839" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2402034" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515815" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515820" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515827" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515838" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515839" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-70641.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:70641" }, { "url": "https://go.dev/cl/803681" }, { "url": "https://go.dev/issue/80494" }, { "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI" }, { "url": "https://linux.oracle.com/cve/CVE-2026-56860.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-70641.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56860" }, { "url": "https://pkg.go.dev/vuln/GO-2026-6218" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-56860" } ], "published": "2026-08-13T22:17:22+00:00", "updated": "2026-09-03T16:37:52+00:00", "affects": [ { "ref": "pkg:golang/stdlib@v1.25.11", "versions": [ { "version": "v1.25.11", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.25.11", "versions": [ { "version": "v1.25.11", "status": "affected" } ] }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:golang/stdlib@v1.25.11" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-56862", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "bitnami" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "rocky" }, "severity": "high" } ], "cwes": [ 770 ], "description": "Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.", "recommendation": "Upgrade stdlib to version 1.25.13, 1.26.6, 1.27.0-rc.3", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-56862" }, { "url": "https://access.redhat.com/errata/RHSA-2026:70641" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-56862" }, { "url": "https://bugzilla.redhat.com/2515815" }, { "url": "https://bugzilla.redhat.com/2515820" }, { "url": "https://bugzilla.redhat.com/2515827" }, { "url": "https://bugzilla.redhat.com/2515838" }, { "url": "https://bugzilla.redhat.com/2515839" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2402034" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515815" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515820" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515827" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515838" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515839" }, { "url": "https://creativecommons.org/licenses/by/4.0/" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-70641.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:70641" }, { "url": "https://go.dev/cl/804261" }, { "url": "https://go.dev/issue/80528" }, { "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI" }, { "url": "https://linux.oracle.com/cve/CVE-2026-56862.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-70641.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56862" }, { "url": "https://pkg.go.dev/vuln/GO-2026-6090" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-56862" } ], "published": "2026-08-13T22:17:22+00:00", "updated": "2026-09-03T16:37:52+00:00", "affects": [ { "ref": "pkg:golang/stdlib@v1.25.11", "versions": [ { "version": "v1.25.11", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.25.11", "versions": [ { "version": "v1.25.11", "status": "affected" } ] }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:golang/stdlib@v1.25.11" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-56866", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [], "description": "When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning.", "recommendation": "Upgrade stdlib to version 1.26.9, 1.27.2", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-56866" }, { "url": "https://go.dev/cl/847306" }, { "url": "https://go.dev/issue/81740" }, { "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI" }, { "url": "https://pkg.go.dev/vuln/GO-2026-6605" } ], "published": "2026-10-08T23:17:01+00:00", "updated": "2026-10-08T23:17:01+00:00", "affects": [ { "ref": "pkg:golang/stdlib@v1.25.11", "versions": [ { "version": "v1.25.11", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.25.11", "versions": [ { "version": "v1.25.11", "status": "affected" } ] }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:golang/stdlib@v1.25.11" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-78667", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [ { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "description": "When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.", "recommendation": "Upgrade stdlib to version 1.26.9, 1.27.2", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-78667" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-78667" }, { "url": "https://go.dev/cl/847309" }, { "url": "https://go.dev/issue/81858" }, { "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78667" }, { "url": "https://pkg.go.dev/vuln/GO-2026-6609" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-78667" } ], "published": "2026-10-08T23:17:03+00:00", "updated": "2026-10-08T23:17:03+00:00", "affects": [ { "ref": "pkg:golang/stdlib@v1.25.11", "versions": [ { "version": "v1.25.11", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.25.11", "versions": [ { "version": "v1.25.11", "status": "affected" } ] }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:golang/stdlib@v1.25.11" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-94439", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [ { "source": { "name": "redhat" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" } ], "description": "When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP. The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP.", "recommendation": "Upgrade stdlib to version 1.26.9, 1.27.2", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-94439" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-94439" }, { "url": "https://go.dev/cl/847311" }, { "url": "https://go.dev/issue/81744" }, { "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94439" }, { "url": "https://pkg.go.dev/vuln/GO-2026-6613" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-94439" } ], "published": "2026-10-08T23:17:04+00:00", "updated": "2026-10-08T23:17:04+00:00", "affects": [ { "ref": "pkg:golang/stdlib@v1.25.11", "versions": [ { "version": "v1.25.11", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.25.11", "versions": [ { "version": "v1.25.11", "status": "affected" } ] }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:golang/stdlib@v1.25.11" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-94440", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [], "description": "Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.", "recommendation": "Upgrade stdlib to version 1.26.9, 1.27.2", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-94440" }, { "url": "https://go.dev/cl/847307" }, { "url": "https://go.dev/issue/81741" }, { "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI" }, { "url": "https://pkg.go.dev/vuln/GO-2026-6608" } ], "published": "2026-10-08T23:17:04+00:00", "updated": "2026-10-08T23:17:04+00:00", "affects": [ { "ref": "pkg:golang/stdlib@v1.25.11", "versions": [ { "version": "v1.25.11", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.25.11", "versions": [ { "version": "v1.25.11", "status": "affected" } ] }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:golang/stdlib@v1.25.11" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-94448", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [], "description": "When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped.", "recommendation": "Upgrade stdlib to version 1.26.9, 1.27.2", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-94448" }, { "url": "https://go.dev/cl/839866" }, { "url": "https://go.dev/issue/81821" }, { "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI" }, { "url": "https://pkg.go.dev/vuln/GO-2026-6599" } ], "published": "2026-10-08T23:17:05+00:00", "updated": "2026-10-08T23:17:05+00:00", "affects": [ { "ref": "pkg:golang/stdlib@v1.25.11", "versions": [ { "version": "v1.25.11", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.25.11", "versions": [ { "version": "v1.25.11", "status": "affected" } ] }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:golang/stdlib@v1.25.11" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-97030", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [], "description": "A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped.", "recommendation": "Upgrade stdlib to version 1.26.9, 1.27.2", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-97030" }, { "url": "https://go.dev/cl/840925" }, { "url": "https://go.dev/issue/81823" }, { "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI" }, { "url": "https://pkg.go.dev/vuln/GO-2026-6600" } ], "published": "2026-10-08T23:17:05+00:00", "updated": "2026-10-08T23:17:05+00:00", "affects": [ { "ref": "pkg:golang/stdlib@v1.25.11", "versions": [ { "version": "v1.25.11", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.25.11", "versions": [ { "version": "v1.25.11", "status": "affected" } ] }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:golang/stdlib@v1.25.11" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-97031", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [ { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "description": "Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector as a result.", "recommendation": "Upgrade stdlib to version 1.26.9, 1.27.2", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-97031" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-97031" }, { "url": "https://go.dev/cl/847312" }, { "url": "https://go.dev/issue/81855" }, { "url": "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97031" }, { "url": "https://pkg.go.dev/vuln/GO-2026-6607" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-97031" } ], "published": "2026-10-08T23:17:06+00:00", "updated": "2026-10-08T23:17:06+00:00", "affects": [ { "ref": "pkg:golang/stdlib@v1.25.11", "versions": [ { "version": "v1.25.11", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.25.11", "versions": [ { "version": "v1.25.11", "status": "affected" } ] }, { "ref": "urn:cdx:bb0bd047-7aab-4d4b-bc87-a7895c43e08c/1#pkg:golang/stdlib@v1.25.11" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } } ] }