{
"$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
"bomFormat": "CycloneDX",
"specVersion": "1.6",
"serialNumber": "urn:uuid:d344e804-c382-456c-af3e-c4cb223eb393",
"version": 1,
"metadata": {
"timestamp": "2026-06-18T15:11:32+00:00",
"tools": {
"components": [
{
"type": "application",
"manufacturer": {
"name": "Aqua Security Software Ltd."
},
"group": "aquasecurity",
"name": "trivy",
"version": "0.69.3"
}
]
},
"component": {
"bom-ref": "pkg:oci/cp-zookeeper@sha256%3A6aefee38999c73aa876f07eaaed8f8a64a877beb30ab3c56769ae843ec24bed6?arch=amd64&repository_url=519856050701.dkr.ecr.us-west-2.amazonaws.com%2Fdocker%2Fprod%2Fconfluentinc%2Fcp-zookeeper",
"type": "container",
"supplier": {
"name": "Confluent"
},
"name": "cp-zookeeper",
"version": "7.5.15",
"purl": "pkg:oci/cp-zookeeper@sha256%3A6aefee38999c73aa876f07eaaed8f8a64a877beb30ab3c56769ae843ec24bed6?arch=amd64&repository_url=519856050701.dkr.ecr.us-west-2.amazonaws.com%2Fdocker%2Fprod%2Fconfluentinc%2Fcp-zookeeper",
"properties": [
{
"name": "aquasecurity:trivy:DiffID",
"value": "sha256:17624a35b509978dc0dd23e5987dae8bc8fac403ee793dd2a90cb8e55aa08b0d"
},
{
"name": "aquasecurity:trivy:DiffID",
"value": "sha256:2c5ff7c1dd45019a610ef90c84c3947b25c487eb71ae0986569f0bd5f759c6d2"
},
{
"name": "aquasecurity:trivy:DiffID",
"value": "sha256:428829592efa927ee11cfe8a1a93b99a1c2e67a8e51bbeb160728de004455557"
},
{
"name": "aquasecurity:trivy:DiffID",
"value": "sha256:4f99902e9ececb7896ba1a7de2fa7934ce1b2ed30f1b096e0dd0054c0c394179"
},
{
"name": "aquasecurity:trivy:DiffID",
"value": "sha256:6beb4b8788604800e74e8ab0e1967c85608c8dc19e4c4232643695e76030da4c"
},
{
"name": "aquasecurity:trivy:DiffID",
"value": "sha256:8d8c5bec7f150ab7e447fb996c3da45d2882f9fc1cf9be3a4b51967e5e4245d3"
},
{
"name": "aquasecurity:trivy:DiffID",
"value": "sha256:90247abc61c97b0ef21596a52de8618e324435c49fbb40784f853e12a806ad79"
},
{
"name": "aquasecurity:trivy:DiffID",
"value": "sha256:9217fb581ac33352f578a6307c0728d10914c2805d98a177b651d064eb93a0d0"
},
{
"name": "aquasecurity:trivy:DiffID",
"value": "sha256:ae1373eeb2cf2c49d4bfdd9b4e3152c0d6b5c79049b8e7dc53c129670c54167e"
},
{
"name": "aquasecurity:trivy:DiffID",
"value": "sha256:bd7c6a63f506bdbc45a279e5d6aee1e12b47cf3f099e0c8f71b9c6067ae201c4"
},
{
"name": "aquasecurity:trivy:DiffID",
"value": "sha256:d7b06b50022a18ee37d6d8449c406686843a8687051aa72f3dafe96101728d8f"
},
{
"name": "aquasecurity:trivy:DiffID",
"value": "sha256:ec0c3728f041db58ba2a0d7fb766cfecb36dc8b4b2858be278f74581f11611d5"
},
{
"name": "aquasecurity:trivy:ImageID",
"value": "sha256:c02b35505f41da3ef970e765997b097f7082b3348bf9cffc47335c7642e3ca4a"
},
{
"name": "aquasecurity:trivy:Labels:architecture",
"value": "x86_64"
},
{
"name": "aquasecurity:trivy:Labels:build-date",
"value": "2026-06-04T05:23:23Z"
},
{
"name": "aquasecurity:trivy:Labels:com.redhat.component",
"value": "ubi8-minimal-container"
},
{
"name": "aquasecurity:trivy:Labels:com.redhat.license_terms",
"value": "https://www.redhat.com/en/about/red-hat-end-user-license-agreements#UBI"
},
{
"name": "aquasecurity:trivy:Labels:cpe",
"value": "cpe:/a:redhat:enterprise_linux:8::appstream"
},
{
"name": "aquasecurity:trivy:Labels:description",
"value": "ZooKeeper is a centralized service for maintaining configuration information, naming, providing distributed synchronization, and providing group services."
},
{
"name": "aquasecurity:trivy:Labels:distribution-scope",
"value": "public"
},
{
"name": "aquasecurity:trivy:Labels:io.buildah.version",
"value": "1.42.2"
},
{
"name": "aquasecurity:trivy:Labels:io.confluent.docker",
"value": "true"
},
{
"name": "aquasecurity:trivy:Labels:io.confluent.docker.build.number",
"value": "0fc9bf7a"
},
{
"name": "aquasecurity:trivy:Labels:io.confluent.docker.git.id",
"value": "2fb7d6c"
},
{
"name": "aquasecurity:trivy:Labels:io.confluent.docker.git.repo",
"value": "confluentinc/kafka-images"
},
{
"name": "aquasecurity:trivy:Labels:io.k8s.description",
"value": "The Universal Base Image Minimal is a stripped down image that uses microdnf as a package manager. This base image is freely redistributable, but Red Hat only supports Red Hat technologies through subscriptions for Red Hat products. This image is maintained by Red Hat and updated regularly."
},
{
"name": "aquasecurity:trivy:Labels:io.k8s.display-name",
"value": "Red Hat Universal Base Image 8 Minimal"
},
{
"name": "aquasecurity:trivy:Labels:io.openshift.tags",
"value": "minimal rhel8"
},
{
"name": "aquasecurity:trivy:Labels:maintainer",
"value": "partner-support@confluent.io"
},
{
"name": "aquasecurity:trivy:Labels:name",
"value": "cp-zookeeper"
},
{
"name": "aquasecurity:trivy:Labels:org.opencontainers.image.created",
"value": "2026-06-04T05:23:23Z"
},
{
"name": "aquasecurity:trivy:Labels:org.opencontainers.image.revision",
"value": "549b6124ef2012922794aa0bb4435f0f6a52deb4"
},
{
"name": "aquasecurity:trivy:Labels:release",
"value": "7.5.15-19"
},
{
"name": "aquasecurity:trivy:Labels:summary",
"value": "ZooKeeper is a centralized service for maintaining configuration information, naming, providing distributed synchronization, and providing group services."
},
{
"name": "aquasecurity:trivy:Labels:url",
"value": "https://catalog.redhat.com/en/search?searchType=containers"
},
{
"name": "aquasecurity:trivy:Labels:vcs-ref",
"value": "549b6124ef2012922794aa0bb4435f0f6a52deb4"
},
{
"name": "aquasecurity:trivy:Labels:vcs-type",
"value": "git"
},
{
"name": "aquasecurity:trivy:Labels:vendor",
"value": "Confluent"
},
{
"name": "aquasecurity:trivy:Labels:version",
"value": "2fb7d6c"
},
{
"name": "aquasecurity:trivy:Reference",
"value": "519856050701.dkr.ecr.us-west-2.amazonaws.com/docker/prod/confluentinc/cp-zookeeper:7.5.15-rc260605063603-latest-ubi8"
},
{
"name": "aquasecurity:trivy:RepoDigest",
"value": "519856050701.dkr.ecr.us-west-2.amazonaws.com/docker/prod/confluentinc/cp-zookeeper@sha256:6aefee38999c73aa876f07eaaed8f8a64a877beb30ab3c56769ae843ec24bed6"
},
{
"name": "aquasecurity:trivy:RepoTag",
"value": "519856050701.dkr.ecr.us-west-2.amazonaws.com/docker/prod/confluentinc/cp-zookeeper:7.5.15-rc260605063603-latest-ubi8"
},
{
"name": "aquasecurity:trivy:SchemaVersion",
"value": "2"
},
{
"name": "aquasecurity:trivy:Size",
"value": "1369438208"
}
]
}
},
"components": [],
"dependencies": [],
"vulnerabilities": [
{
"id": "CVE-2005-2541",
"ratings": [
{
"source": {
"name": "nvd"
},
"score": 10,
"severity": "high",
"method": "CVSSv2",
"vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"
},
{
"source": {
"name": "redhat"
},
"score": 7,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"description": "Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2005-2541"
},
{
"url": "http://marc.info/?l=bugtraq&m=112327628230258&w=2"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2005-2541"
},
{
"url": "https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c%40%3Cissues.guacamole.apache.org%3E"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2005-2541"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2005-2541"
}
],
"published": "2005-08-10T04:00:00+00:00",
"updated": "2026-04-16T00:27:16+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2",
"versions": [
{
"version": "2:1.30-11.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2018-1000654",
"ratings": [
{
"source": {
"name": "nvd"
},
"score": 7.1,
"severity": "high",
"method": "CVSSv2",
"vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C"
},
{
"source": {
"name": "nvd"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 4,
"severity": "low",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"description": "GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically CPU usage will reach 100% when running asn1Paser against the POC due to an issue in _asn1_expand_object_id(p_tree), after a long time, the program will be killed. This attack appears to be exploitable via parsing a crafted file.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2018-1000654"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00009.html"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00018.html"
},
{
"url": "http://www.securityfocus.com/bid/105151"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2018-1000654"
},
{
"url": "https://gitlab.com/gnutls/libtasn1/issues/4"
},
{
"url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000654"
},
{
"url": "https://ubuntu.com/security/notices/USN-5352-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1000654"
}
],
"published": "2018-08-20T19:31:44+00:00",
"updated": "2024-11-21T03:40:20+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "4.13-5.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2018-1000879",
"ratings": [
{
"source": {
"name": "nvd"
},
"score": 4.3,
"severity": "medium",
"method": "CVSSv2",
"vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
},
{
"source": {
"name": "nvd"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 4.3,
"severity": "low",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
}
],
"cwes": [
476
],
"description": "libarchive version commit 379867ecb330b3a952fb7bfa7bffb7bbd5547205 onwards (release v3.3.0 onwards) contains a CWE-476: NULL Pointer Dereference vulnerability in ACL parser - libarchive/archive_acl.c, archive_acl_from_text_l() that can result in Crash/DoS. This attack appear to be exploitable via the victim must open a specially crafted archive file.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2018-1000879"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00055.html"
},
{
"url": "http://www.securityfocus.com/bid/106324"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2018-1000879"
},
{
"url": "https://bugs.launchpad.net/ubuntu/+source/libarchive/+bug/1794909"
},
{
"url": "https://github.com/libarchive/libarchive/pull/1105"
},
{
"url": "https://github.com/libarchive/libarchive/pull/1105/commits/15bf44fd2c1ad0e3fd87048b3fcc90c4dcff1175"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CBOCC2M6YGPZA6US43YK4INPSJZZHRTG/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W645KCLWFDBDGFJHG57WOVXGE62QSIJI/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVXA7PHINVT6DFF6PRLTDTVTXKDLVHNF/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000879"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1000879"
}
],
"published": "2018-12-20T17:29:01+00:00",
"updated": "2024-11-21T03:40:34+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.3.3-7.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2018-1000880",
"ratings": [
{
"source": {
"name": "nvd"
},
"score": 4.3,
"severity": "medium",
"method": "CVSSv2",
"vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
},
{
"source": {
"name": "nvd"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 4.3,
"severity": "low",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
119
],
"description": "libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0 onwards) contains a CWE-20: Improper Input Validation vulnerability in WARC parser - libarchive/archive_read_support_format_warc.c, _warc_read() that can result in DoS - quasi-infinite run time and disk usage from tiny file. This attack appear to be exploitable via the victim must open a specially crafted WARC file.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2018-1000880"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00055.html"
},
{
"url": "http://www.securityfocus.com/bid/106324"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2018-1000880"
},
{
"url": "https://bugs.launchpad.net/ubuntu/+source/libarchive/+bug/1794909"
},
{
"url": "https://github.com/libarchive/libarchive/pull/1105"
},
{
"url": "https://github.com/libarchive/libarchive/pull/1105/commits/9c84b7426660c09c18cc349f6d70b5f8168b5680"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CBOCC2M6YGPZA6US43YK4INPSJZZHRTG/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W645KCLWFDBDGFJHG57WOVXGE62QSIJI/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVXA7PHINVT6DFF6PRLTDTVTXKDLVHNF/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000880"
},
{
"url": "https://ubuntu.com/security/notices/USN-3859-1"
},
{
"url": "https://usn.ubuntu.com/3859-1/"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1000880"
},
{
"url": "https://www.debian.org/security/2018/dsa-4360"
}
],
"published": "2018-12-20T17:29:01+00:00",
"updated": "2024-11-21T03:40:34+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.3.3-7.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2018-1121",
"ratings": [
{
"source": {
"name": "nvd"
},
"score": 4.3,
"severity": "medium",
"method": "CVSSv2",
"vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"
},
{
"source": {
"name": "nvd"
},
"score": 5.9,
"severity": "medium",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"
},
{
"source": {
"name": "redhat"
},
"score": 3.9,
"severity": "low",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
367,
362
],
"description": "procps-ng, procps is vulnerable to a process hiding through race condition. Since the kernel's proc_pid_readdir() returns PID entries in ascending numeric order, a process occupying a high PID can use inotify events to determine when the process list is being scanned, and fork/exec to obtain a lower PID, thus avoiding enumeration. An unprivileged attacker can hide a process from procps-ng's utilities by exploiting a race condition in reading /proc/PID entries. This vulnerability affects procps and procps-ng up to version 3.3.15, newer versions might be affected also.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2018-1121"
},
{
"url": "http://seclists.org/oss-sec/2018/q2/122"
},
{
"url": "http://www.securityfocus.com/bid/104214"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2018-1121"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1121"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1121"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1121"
},
{
"url": "https://www.exploit-db.com/exploits/44806/"
},
{
"url": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"
}
],
"published": "2018-06-13T20:29:00+00:00",
"updated": "2024-11-21T03:59:13+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.3.15-14.el8",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2018-19211",
"ratings": [
{
"source": {
"name": "nvd"
},
"score": 4.3,
"severity": "medium",
"method": "CVSSv2",
"vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
},
{
"source": {
"name": "nvd"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 4.7,
"severity": "low",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
476
],
"description": "In ncurses 6.1, there is a NULL pointer dereference at function _nc_parse_entry in parse_entry.c that will lead to a denial of service attack. The product proceeds to the dereference code path even after a \"dubious character `*' in name or alias field\" detection.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2018-19211"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2018-19211"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1643754"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19211"
},
{
"url": "https://ubuntu.com/security/notices/USN-5477-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2018-19211"
}
],
"published": "2018-11-12T19:29:00+00:00",
"updated": "2024-11-21T03:57:34+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "6.1-10.20180224.el8",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "6.1-10.20180224.el8",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2018-20225",
"ratings": [
{
"source": {
"name": "cbl-mariner"
},
"severity": "high"
},
{
"source": {
"name": "nvd"
},
"score": 6.8,
"severity": "medium",
"method": "CVSSv2",
"vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"
},
{
"source": {
"name": "nvd"
},
"score": 7.8,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 7.8,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"cwes": [
20
],
"description": "An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2018-20225"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2018-20225"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1835736"
},
{
"url": "https://cowlicks.website/posts/arbitrary-code-execution-from-pips-extra-index-url.html"
},
{
"url": "https://lists.apache.org/thread.html/rb1adce798445facd032870d644eb39c4baaf9c4a7dd5477d12bb6ab2%40%3Cgithub.arrow.apache.org%3E"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20225"
},
{
"url": "https://pip.pypa.io/en/stable/news/"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2018-20225"
}
],
"published": "2020-05-08T18:15:10+00:00",
"updated": "2026-04-15T21:17:00+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "9.0.3-24.el8",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "9.0.3-24.el8",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable. "
}
},
{
"id": "CVE-2018-20657",
"ratings": [
{
"source": {
"name": "nvd"
},
"score": 5,
"severity": "medium",
"method": "CVSSv2",
"vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
},
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "low"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 3.3,
"severity": "low",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
772
],
"description": "The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, has a memory leak via a crafted string, leading to a denial of service (memory consumption), as demonstrated by cxxfilt, a related issue to CVE-2018-12698.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2018-20657"
},
{
"url": "http://www.securityfocus.com/bid/106444"
},
{
"url": "https://access.redhat.com/errata/RHSA-2019:3352"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2018-20657"
},
{
"url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88539"
},
{
"url": "https://linux.oracle.com/cve/CVE-2018-20657.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2019-3352.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20657"
},
{
"url": "https://support.f5.com/csp/article/K62602089"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2018-20657"
}
],
"published": "2019-01-02T14:29:00+00:00",
"updated": "2024-11-21T04:01:56+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "8.5.0-28.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "8.5.0-28.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2018-20839",
"ratings": [
{
"source": {
"name": "nvd"
},
"score": 4.3,
"severity": "medium",
"method": "CVSSv2",
"vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"
},
{
"source": {
"name": "nvd"
},
"score": 4.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "redhat"
},
"score": 4.3,
"severity": "medium",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
}
],
"description": "systemd 242 changes the VT1 mode upon a logout, which allows attackers to read cleartext passwords in certain circumstances, such as watching a shutdown, or using Ctrl-Alt-F1 and Ctrl-Alt-F2. This occurs because the KDGKBMODE (aka current keyboard mode) check is mishandled.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2018-20839"
},
{
"url": "http://www.securityfocus.com/bid/108389"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2018-20839"
},
{
"url": "https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1803993"
},
{
"url": "https://github.com/systemd/systemd/commit/9725f1a10f80f5e0ae7d9b60547458622aeb322f"
},
{
"url": "https://github.com/systemd/systemd/pull/12378"
},
{
"url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20839"
},
{
"url": "https://security.netapp.com/advisory/ntap-20190530-0002/"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2018-20839"
}
],
"published": "2019-05-17T04:29:00+00:00",
"updated": "2025-05-05T14:14:36+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "239-82.el8_10.16",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "239-82.el8_10.16",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "239-82.el8_10.16",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2018-25282",
"ratings": [
{
"source": {
"name": "redhat"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
}
],
"cwes": [
674
],
"description": "Nmap 7.70 contains a denial of service vulnerability that allows local attackers to crash the application by processing malicious XML files with exponential entity expansion. Attackers can create a crafted XML file with nested entity definitions and open it through ZenMap's scan import functionality to cause the program to consume excessive system resources and crash.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2018-25282"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2018-25282"
},
{
"url": "https://nmap.org/dist/nmap-7.70-setup.exe"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-25282"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2018-25282"
},
{
"url": "https://www.exploit-db.com/exploits/45357"
},
{
"url": "https://www.vulncheck.com/advisories/nmap-denial-of-service-via-xml-entity-expansion"
}
],
"published": "2026-04-26T22:17:28+00:00",
"updated": "2026-04-27T18:55:32+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/nmap-ncat@7.92-2.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2",
"versions": [
{
"version": "2:7.92-2.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/nmap-ncat@7.92-2.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/nmap-ncat@7.92-2.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/nmap-ncat@7.92-2.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/nmap-ncat@7.92-2.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/nmap-ncat@7.92-2.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/nmap-ncat@7.92-2.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/nmap-ncat@7.92-2.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/nmap-ncat@7.92-2.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/nmap-ncat@7.92-2.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/nmap-ncat@7.92-2.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/nmap-ncat@7.92-2.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/nmap-ncat@7.92-2.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/nmap-ncat@7.92-2.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/nmap-ncat@7.92-2.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/nmap-ncat@7.92-2.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/nmap-ncat@7.92-2.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/nmap-ncat@7.92-2.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/nmap-ncat@7.92-2.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/nmap-ncat@7.92-2.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2019-12904",
"ratings": [
{
"source": {
"name": "nvd"
},
"score": 4.3,
"severity": "medium",
"method": "CVSSv2",
"vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"
},
{
"source": {
"name": "nvd"
},
"score": 5.9,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.9,
"severity": "medium",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"cwes": [
668
],
"description": "In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. (The C implementation is used on platforms where an assembly-language implementation is unavailable.) NOTE: the vendor's position is that the issue report cannot be validated because there is no description of an attack",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2019-12904"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00049.html"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2019-12904"
},
{
"url": "https://dev.gnupg.org/T4541"
},
{
"url": "https://github.com/gpg/libgcrypt/commit/a4c561aab1014c3630bc88faf6f5246fee16b020"
},
{
"url": "https://github.com/gpg/libgcrypt/commit/daedbbb5541cd8ecda1459d3b843ea4d92788762"
},
{
"url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"
},
{
"url": "https://lists.gnupg.org/pipermail/gcrypt-devel/2019-July/004760.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12904"
},
{
"url": "https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-12904.html"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2019-12904"
}
],
"published": "2019-06-20T00:15:10+00:00",
"updated": "2024-11-21T04:23:48+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.8.5-7.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2019-14250",
"ratings": [
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 4.3,
"severity": "medium",
"method": "CVSSv2",
"vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
},
{
"source": {
"name": "nvd"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 3.3,
"severity": "low",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
190,
787
],
"description": "An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. simple_object_elf_match in simple-object-elf.c does not check for a zero shstrndx value, leading to an integer overflow and resultant heap-based buffer overflow.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2019-14250"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00056.html"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00057.html"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00058.html"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00078.html"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00004.html"
},
{
"url": "http://www.securityfocus.com/bid/109354"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2019-14250"
},
{
"url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=90924"
},
{
"url": "https://gcc.gnu.org/ml/gcc-patches/2019-07/msg01003.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14250"
},
{
"url": "https://security.gentoo.org/glsa/202007-39"
},
{
"url": "https://security.netapp.com/advisory/ntap-20190822-0002/"
},
{
"url": "https://ubuntu.com/security/notices/USN-4326-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-4336-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-4336-2"
},
{
"url": "https://usn.ubuntu.com/4326-1/"
},
{
"url": "https://usn.ubuntu.com/4336-1/"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2019-14250"
}
],
"published": "2019-07-24T04:15:12+00:00",
"updated": "2024-11-21T04:26:17+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "8.5.0-28.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "8.5.0-28.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2019-16866",
"ratings": [
{
"source": {
"name": "nvd"
},
"score": 5,
"severity": "medium",
"method": "CVSSv2",
"vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
},
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 5.3,
"severity": "low",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
755,
908
],
"description": "Unbound before 1.9.4 accesses uninitialized memory, which allows remote attackers to trigger a crash via a crafted NOTIFY query. The source IP address of the query must match an access-control rule.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2019-16866"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2019-16866"
},
{
"url": "https://github.com/NLnetLabs/unbound/blob/release-1.9.4/doc/Changelog"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E65NCWZZB2D75ZIYWPXKMVGSGNYW4JMC/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MLRHE7TQFAOV4MB2ELTOGESZYUL65NUJ/"
},
{
"url": "https://nlnetlabs.nl/downloads/unbound/CVE-2019-16866.txt"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16866"
},
{
"url": "https://seclists.org/bugtraq/2019/Oct/23"
},
{
"url": "https://ubuntu.com/security/notices/USN-4149-1"
},
{
"url": "https://usn.ubuntu.com/4149-1/"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2019-16866"
},
{
"url": "https://www.debian.org/security/2019/dsa-4544"
}
],
"published": "2019-10-03T19:15:09+00:00",
"updated": "2024-11-21T04:31:14+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.16.2-5.10.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.16.2-5.10.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2019-19244",
"ratings": [
{
"source": {
"name": "nvd"
},
"score": 5,
"severity": "medium",
"method": "CVSSv2",
"vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
},
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 7.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"description": "sqlite3Select in select.c in SQLite 3.30.1 allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2019-19244"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2019-19244"
},
{
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"
},
{
"url": "https://github.com/sqlite/sqlite/commit/e59c562b3f6894f84c715772c4b116d7b5c01348"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19244"
},
{
"url": "https://ubuntu.com/security/notices/USN-4205-1"
},
{
"url": "https://usn.ubuntu.com/4205-1/"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2019-19244"
},
{
"url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
}
],
"published": "2019-11-25T20:15:11+00:00",
"updated": "2024-11-21T04:34:24+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.26.0-20.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2019-8905",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 3.6,
"severity": "info",
"method": "CVSSv2",
"vector": "AV:L/AC:L/Au:N/C:P/I:N/A:P"
},
{
"source": {
"name": "nvd"
},
"score": 4.4,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 4.4,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
125
],
"description": "do_core_note in readelf.c in libmagic.a in file 5.35 has a stack-based buffer over-read, related to file_printable, a different vulnerability than CVE-2018-10360.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2019-8905"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00027.html"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00053.html"
},
{
"url": "http://www.securityfocus.com/bid/107137"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2019-8905"
},
{
"url": "https://bugs.astron.com/view.php?id=63"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00044.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8905"
},
{
"url": "https://ubuntu.com/security/notices/USN-3911-1"
},
{
"url": "https://usn.ubuntu.com/3911-1/"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2019-8905"
}
],
"published": "2019-02-18T17:29:00+00:00",
"updated": "2024-11-21T04:50:38+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "5.33-27.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable.\nFor python:"
}
},
{
"id": "CVE-2019-8906",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 3.6,
"severity": "info",
"method": "CVSSv2",
"vector": "AV:L/AC:L/Au:N/C:P/I:N/A:P"
},
{
"source": {
"name": "nvd"
},
"score": 4.4,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 4.4,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
125
],
"description": "do_core_note in readelf.c in libmagic.a in file 5.35 has an out-of-bounds read because memcpy is misused.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2019-8906"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00027.html"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00053.html"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2019-8906"
},
{
"url": "https://bugs.astron.com/view.php?id=64"
},
{
"url": "https://github.com/file/file/commit/2858eaf99f6cc5aae129bcbf1e24ad160240185f"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8906"
},
{
"url": "https://support.apple.com/kb/HT209599"
},
{
"url": "https://support.apple.com/kb/HT209600"
},
{
"url": "https://support.apple.com/kb/HT209601"
},
{
"url": "https://support.apple.com/kb/HT209602"
},
{
"url": "https://ubuntu.com/security/notices/USN-3911-1"
},
{
"url": "https://usn.ubuntu.com/3911-1/"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2019-8906"
}
],
"published": "2019-02-18T17:29:01+00:00",
"updated": "2024-11-21T04:50:38+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "5.33-27.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable.\nFor python:"
}
},
{
"id": "CVE-2019-9674",
"ratings": [
{
"source": {
"name": "cbl-mariner"
},
"severity": "high"
},
{
"source": {
"name": "nvd"
},
"score": 5,
"severity": "medium",
"method": "CVSSv2",
"vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
},
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 4.2,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
400
],
"description": "Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2019-9674"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00003.html"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00041.html"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2019-9674"
},
{
"url": "https://bugs.python.org/issue36260"
},
{
"url": "https://bugs.python.org/issue36462"
},
{
"url": "https://github.com/python/cpython/blob/master/Lib/zipfile.py"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9674"
},
{
"url": "https://python-security.readthedocs.io/security.html#archives-and-zip-bomb"
},
{
"url": "https://security.netapp.com/advisory/ntap-20200221-0003/"
},
{
"url": "https://ubuntu.com/security/notices/USN-4428-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-4754-3"
},
{
"url": "https://ubuntu.com/security/notices/USN-6891-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7212-1"
},
{
"url": "https://usn.ubuntu.com/4428-1/"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2019-9674"
},
{
"url": "https://www.python.org/news/security/"
}
],
"published": "2020-02-04T15:15:11+00:00",
"updated": "2025-12-31T00:55:36+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-76.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-76.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2019-9923",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 5,
"severity": "medium",
"method": "CVSSv2",
"vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
},
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 3.3,
"severity": "low",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
476
],
"description": "pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2019-9923"
},
{
"url": "http://git.savannah.gnu.org/cgit/tar.git/commit/?id=cb07844454d8cc9fb21f53ace75975f91185a120"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00077.html"
},
{
"url": "http://savannah.gnu.org/bugs/?55369"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2019-9923"
},
{
"url": "https://bugs.launchpad.net/ubuntu/+source/tar/+bug/1810241"
},
{
"url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9923"
},
{
"url": "https://ubuntu.com/security/notices/USN-4692-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2019-9923"
}
],
"published": "2019-03-22T08:29:00+00:00",
"updated": "2025-08-06T22:15:28+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2",
"versions": [
{
"version": "2:1.30-11.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2019-9936",
"ratings": [
{
"source": {
"name": "nvd"
},
"score": 5,
"severity": "medium",
"method": "CVSSv2",
"vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"
},
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 3.3,
"severity": "low",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
125
],
"description": "In SQLite 3.27.2, running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read in fts5HashEntrySort in sqlite3.c, which may lead to an information leak. This is related to ext/fts5/fts5_hash.c.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2019-9936"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00026.html"
},
{
"url": "http://www.securityfocus.com/bid/107562"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2019-9936"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXD2GYJVTDGEQPUNMMMC5TB7MQXOBBMO/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N66U5PY5UJU4XBFZJH7QNKIDNAVIB4OP/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9936"
},
{
"url": "https://security.gentoo.org/glsa/201908-09"
},
{
"url": "https://security.netapp.com/advisory/ntap-20190416-0005/"
},
{
"url": "https://sqlite.org/src/info/b3fa58dd7403dbd4"
},
{
"url": "https://ubuntu.com/security/notices/USN-4019-1"
},
{
"url": "https://usn.ubuntu.com/4019-1/"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2019-9936"
},
{
"url": "https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg114382.html"
},
{
"url": "https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg114394.html"
},
{
"url": "https://www.mail-archive.com/sqlite-users@mailinglists.sqlite.org/msg114382.html"
},
{
"url": "https://www.mail-archive.com/sqlite-users@mailinglists.sqlite.org/msg114394.html"
},
{
"url": "https://www.oracle.com/security-alerts/cpujan2020.html"
},
{
"url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
}
],
"published": "2019-03-22T08:29:00+00:00",
"updated": "2024-11-21T04:52:37+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.26.0-20.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2019-9937",
"ratings": [
{
"source": {
"name": "nvd"
},
"score": 5,
"severity": "medium",
"method": "CVSSv2",
"vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
},
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 5.3,
"severity": "low",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
476
],
"description": "In SQLite 3.27.2, interleaving reads and writes in a single transaction with an fts5 virtual table will lead to a NULL Pointer Dereference in fts5ChunkIterate in sqlite3.c. This is related to ext/fts5/fts5_hash.c and ext/fts5/fts5_index.c.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2019-9937"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00026.html"
},
{
"url": "http://www.securityfocus.com/bid/107562"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2019-9937"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXD2GYJVTDGEQPUNMMMC5TB7MQXOBBMO/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N66U5PY5UJU4XBFZJH7QNKIDNAVIB4OP/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9937"
},
{
"url": "https://security.gentoo.org/glsa/201908-09"
},
{
"url": "https://security.netapp.com/advisory/ntap-20190416-0005/"
},
{
"url": "https://sqlite.org/src/info/45c73deb440496e8"
},
{
"url": "https://ubuntu.com/security/notices/USN-4019-1"
},
{
"url": "https://usn.ubuntu.com/4019-1/"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2019-9937"
},
{
"url": "https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg114383.html"
},
{
"url": "https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg114393.html"
},
{
"url": "https://www.mail-archive.com/sqlite-users@mailinglists.sqlite.org/msg114383.html"
},
{
"url": "https://www.mail-archive.com/sqlite-users@mailinglists.sqlite.org/msg114393.html"
},
{
"url": "https://www.oracle.com/security-alerts/cpujan2020.html"
},
{
"url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
}
],
"published": "2019-03-22T08:29:00+00:00",
"updated": "2024-11-21T04:52:37+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.26.0-20.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2020-19185",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 6.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
}
],
"cwes": [
787
],
"description": "Buffer Overflow vulnerability in one_one_mapping function in progs/dump_entry.c:1373 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2020-19185"
},
{
"url": "http://seclists.org/fulldisclosure/2023/Dec/10"
},
{
"url": "http://seclists.org/fulldisclosure/2023/Dec/11"
},
{
"url": "http://seclists.org/fulldisclosure/2023/Dec/9"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2020-19185"
},
{
"url": "https://github.com/zjuchenyuan/fuzzpoc/blob/master/infotocap_poc1.md"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-19185"
},
{
"url": "https://security.netapp.com/advisory/ntap-20231006-0005/"
},
{
"url": "https://support.apple.com/kb/HT214036"
},
{
"url": "https://support.apple.com/kb/HT214037"
},
{
"url": "https://support.apple.com/kb/HT214038"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2020-19185"
}
],
"published": "2023-08-22T19:15:57+00:00",
"updated": "2024-11-21T05:09:00+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "6.1-10.20180224.el8",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "6.1-10.20180224.el8",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2020-19186",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 6.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
}
],
"cwes": [
787
],
"description": "Buffer Overflow vulnerability in _nc_find_entry function in tinfo/comp_hash.c:66 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2020-19186"
},
{
"url": "http://seclists.org/fulldisclosure/2023/Dec/10"
},
{
"url": "http://seclists.org/fulldisclosure/2023/Dec/11"
},
{
"url": "http://seclists.org/fulldisclosure/2023/Dec/9"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2020-19186"
},
{
"url": "https://github.com/zjuchenyuan/fuzzpoc/blob/master/infotocap_poc2.md"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-19186"
},
{
"url": "https://security.netapp.com/advisory/ntap-20231006-0005/"
},
{
"url": "https://support.apple.com/kb/HT214036"
},
{
"url": "https://support.apple.com/kb/HT214037"
},
{
"url": "https://support.apple.com/kb/HT214038"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2020-19186"
}
],
"published": "2023-08-22T19:15:58+00:00",
"updated": "2024-11-21T05:09:00+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "6.1-10.20180224.el8",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "6.1-10.20180224.el8",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2020-19187",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 6.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
}
],
"cwes": [
787
],
"description": "Buffer Overflow vulnerability in fmt_entry function in progs/dump_entry.c:1100 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2020-19187"
},
{
"url": "http://seclists.org/fulldisclosure/2023/Dec/10"
},
{
"url": "http://seclists.org/fulldisclosure/2023/Dec/11"
},
{
"url": "http://seclists.org/fulldisclosure/2023/Dec/9"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2020-19187"
},
{
"url": "https://github.com/zjuchenyuan/fuzzpoc/blob/master/infotocap_poc3.md"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-19187"
},
{
"url": "https://security.netapp.com/advisory/ntap-20231006-0005/"
},
{
"url": "https://support.apple.com/kb/HT214036"
},
{
"url": "https://support.apple.com/kb/HT214037"
},
{
"url": "https://support.apple.com/kb/HT214038"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2020-19187"
}
],
"published": "2023-08-22T19:15:59+00:00",
"updated": "2024-11-21T05:09:00+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "6.1-10.20180224.el8",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "6.1-10.20180224.el8",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2020-19188",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 6.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
}
],
"cwes": [
787
],
"description": "Buffer Overflow vulnerability in fmt_entry function in progs/dump_entry.c:1116 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2020-19188"
},
{
"url": "http://seclists.org/fulldisclosure/2023/Dec/10"
},
{
"url": "http://seclists.org/fulldisclosure/2023/Dec/11"
},
{
"url": "http://seclists.org/fulldisclosure/2023/Dec/9"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2020-19188"
},
{
"url": "https://github.com/zjuchenyuan/fuzzpoc/blob/master/infotocap_poc4.md"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-19188"
},
{
"url": "https://security.netapp.com/advisory/ntap-20231006-0005/"
},
{
"url": "https://support.apple.com/kb/HT214036"
},
{
"url": "https://support.apple.com/kb/HT214037"
},
{
"url": "https://support.apple.com/kb/HT214038"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2020-19188"
}
],
"published": "2023-08-22T19:16:00+00:00",
"updated": "2024-11-21T05:09:00+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "6.1-10.20180224.el8",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "6.1-10.20180224.el8",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2020-19189",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 6.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
787
],
"description": "Buffer Overflow vulnerability in postprocess_terminfo function in tinfo/parse_entry.c:997 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2020-19189"
},
{
"url": "http://seclists.org/fulldisclosure/2023/Dec/10"
},
{
"url": "http://seclists.org/fulldisclosure/2023/Dec/11"
},
{
"url": "http://seclists.org/fulldisclosure/2023/Dec/9"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2020-19189"
},
{
"url": "https://github.com/zjuchenyuan/fuzzpoc/blob/master/infotocap_poc5.md"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00033.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-19189"
},
{
"url": "https://security.netapp.com/advisory/ntap-20231006-0005/"
},
{
"url": "https://support.apple.com/kb/HT214036"
},
{
"url": "https://support.apple.com/kb/HT214037"
},
{
"url": "https://support.apple.com/kb/HT214038"
},
{
"url": "https://ubuntu.com/security/notices/USN-6451-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2020-19189"
}
],
"published": "2023-08-22T19:16:01+00:00",
"updated": "2024-11-21T05:09:00+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "6.1-10.20180224.el8",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "6.1-10.20180224.el8",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2020-19190",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 6.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
}
],
"cwes": [
787
],
"description": "Buffer Overflow vulnerability in _nc_find_entry in tinfo/comp_hash.c:70 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2020-19190"
},
{
"url": "http://seclists.org/fulldisclosure/2023/Dec/10"
},
{
"url": "http://seclists.org/fulldisclosure/2023/Dec/11"
},
{
"url": "http://seclists.org/fulldisclosure/2023/Dec/9"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2020-19190"
},
{
"url": "https://github.com/zjuchenyuan/fuzzpoc/blob/master/infotocap_poc6.md"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-19190"
},
{
"url": "https://security.netapp.com/advisory/ntap-20231006-0005/"
},
{
"url": "https://support.apple.com/kb/HT214036"
},
{
"url": "https://support.apple.com/kb/HT214037"
},
{
"url": "https://support.apple.com/kb/HT214038"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2020-19190"
}
],
"published": "2023-08-22T19:16:01+00:00",
"updated": "2024-11-21T05:09:01+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "6.1-10.20180224.el8",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "6.1-10.20180224.el8",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2020-35512",
"ratings": [
{
"source": {
"name": "nvd"
},
"score": 7.2,
"severity": "high",
"method": "CVSSv2",
"vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"
},
{
"source": {
"name": "nvd"
},
"score": 7.8,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 7,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
416
],
"description": "A use-after-free flaw was found in D-Bus Development branch <= 1.13.16, dbus-1.12.x stable branch <= 1.12.18, and dbus-1.10.x and older branches <= 1.10.30 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2020-35512"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2020-35512"
},
{
"url": "https://bugs.gentoo.org/755392"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1909101"
},
{
"url": "https://gitlab.freedesktop.org/dbus/dbus/-/commit/2b7948ef907669e844b52c4fa2268d6e3162a70c"
},
{
"url": "https://gitlab.freedesktop.org/dbus/dbus/-/commit/dc94fe3d31adf72259adc31f343537151a6c0bdd"
},
{
"url": "https://gitlab.freedesktop.org/dbus/dbus/-/commit/f3b2574f0c9faa32a59efec905921f7ef4438a60"
},
{
"url": "https://gitlab.freedesktop.org/dbus/dbus/-/issues/305"
},
{
"url": "https://gitlab.freedesktop.org/dbus/dbus/-/issues/305#note_829128"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35512"
},
{
"url": "https://security-tracker.debian.org/tracker/CVE-2020-35512"
},
{
"url": "https://ubuntu.com/security/notices/USN-5244-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-5244-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2020-35512"
}
],
"published": "2021-02-15T17:15:12+00:00",
"updated": "2024-11-21T05:27:28+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/dbus-common@1.12.8-28.el8_10?arch=noarch&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.12.8-28.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/dbus-daemon@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.12.8-28.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/dbus-libs@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.12.8-28.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/dbus-tools@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.12.8-28.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/dbus@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.12.8-28.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/dbus-common@1.12.8-28.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/dbus-daemon@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/dbus-libs@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/dbus-tools@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/dbus@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/dbus-common@1.12.8-28.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/dbus-daemon@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/dbus-libs@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/dbus-tools@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/dbus@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/dbus-common@1.12.8-28.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/dbus-daemon@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/dbus-libs@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/dbus-tools@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/dbus@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/dbus-common@1.12.8-28.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/dbus-daemon@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/dbus-libs@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/dbus-tools@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/dbus@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/dbus-common@1.12.8-28.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/dbus-daemon@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/dbus-libs@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/dbus-tools@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/dbus@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/dbus-common@1.12.8-28.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/dbus-daemon@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/dbus-libs@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/dbus-tools@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/dbus@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/dbus-common@1.12.8-28.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/dbus-daemon@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/dbus-libs@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/dbus-tools@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/dbus@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/dbus-common@1.12.8-28.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/dbus-daemon@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/dbus-libs@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/dbus-tools@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/dbus@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/dbus-common@1.12.8-28.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/dbus-daemon@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/dbus-libs@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/dbus-tools@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/dbus@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/dbus-common@1.12.8-28.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/dbus-daemon@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/dbus-libs@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/dbus-tools@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/dbus@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/dbus-common@1.12.8-28.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/dbus-daemon@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/dbus-libs@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/dbus-tools@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/dbus@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/dbus-common@1.12.8-28.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/dbus-daemon@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/dbus-libs@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/dbus-tools@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/dbus@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/dbus-common@1.12.8-28.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/dbus-daemon@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/dbus-libs@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/dbus-tools@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/dbus@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/dbus-common@1.12.8-28.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/dbus-daemon@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/dbus-libs@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/dbus-tools@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/dbus@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/dbus-common@1.12.8-28.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/dbus-daemon@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/dbus-libs@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/dbus-tools@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/dbus@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/dbus-common@1.12.8-28.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/dbus-daemon@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/dbus-libs@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/dbus-tools@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/dbus@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/dbus-common@1.12.8-28.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/dbus-daemon@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/dbus-libs@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/dbus-tools@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/dbus@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/dbus-common@1.12.8-28.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/dbus-daemon@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/dbus-libs@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/dbus-tools@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/dbus@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/dbus-common@1.12.8-28.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/dbus-daemon@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/dbus-libs@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/dbus-tools@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/dbus@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/dbus-common@1.12.8-28.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/dbus-daemon@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/dbus-libs@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/dbus-tools@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/dbus@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/dbus-common@1.12.8-28.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/dbus-daemon@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/dbus-libs@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/dbus-tools@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/dbus@1.12.8-28.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2021-20193",
"ratings": [
{
"source": {
"name": "nvd"
},
"score": 4.3,
"severity": "medium",
"method": "CVSSv2",
"vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
},
{
"source": {
"name": "nvd"
},
"score": 3.3,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "photon"
},
"severity": "low"
},
{
"source": {
"name": "redhat"
},
"score": 3.3,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
401,
125
],
"description": "A flaw was found in the src/list.c of tar 1.33 and earlier. This flaw allows an attacker who can submit a crafted input file to tar to cause uncontrolled consumption of memory. The highest threat from this vulnerability is to system availability.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2021-20193"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2021-20193"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1917565"
},
{
"url": "https://git.savannah.gnu.org/cgit/tar.git/commit/?id=d9d4435692150fa8ff68e1b1a473d187cc3fd777"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20193"
},
{
"url": "https://savannah.gnu.org/bugs/?59897"
},
{
"url": "https://security.gentoo.org/glsa/202105-29"
},
{
"url": "https://ubuntu.com/security/notices/USN-5329-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2021-20193"
}
],
"published": "2021-03-26T17:15:12+00:00",
"updated": "2025-05-05T14:15:04+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2",
"versions": [
{
"version": "2:1.30-11.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2021-24032",
"ratings": [
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 1.9,
"severity": "info",
"method": "CVSSv2",
"vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N"
},
{
"source": {
"name": "nvd"
},
"score": 4.7,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
277,
276
],
"description": "Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with default permissions and restricted those permissions immediately afterwards. Output files could therefore momentarily be readable or writable to unintended parties.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2021-24032"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2021-24032"
},
{
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=982519"
},
{
"url": "https://github.com/advisories/GHSA-ffqj-7pgc-cmj5"
},
{
"url": "https://github.com/facebook/zstd/issues/2491"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-24032"
},
{
"url": "https://ubuntu.com/security/notices/USN-4760-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-5720-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2021-24032"
},
{
"url": "https://www.facebook.com/security/advisories/cve-2021-24032"
}
],
"published": "2021-03-04T21:15:12+00:00",
"updated": "2024-11-21T05:52:14+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.4.4-1.el8",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2021-31879",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 5.8,
"severity": "medium",
"method": "CVSSv2",
"vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"
},
{
"source": {
"name": "nvd"
},
"score": 6.1,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
601
],
"description": "GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2021-31879"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2021-31879"
},
{
"url": "https://mail.gnu.org/archive/html/bug-wget/2021-02/msg00002.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31879"
},
{
"url": "https://savannah.gnu.org/bugs/?56909"
},
{
"url": "https://security.netapp.com/advisory/ntap-20210618-0002/"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2021-31879"
}
],
"published": "2021-04-29T05:15:08+00:00",
"updated": "2024-11-21T06:06:25+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.19.5-12.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2021-39537",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "high"
},
{
"source": {
"name": "nvd"
},
"score": 6.8,
"severity": "medium",
"method": "CVSSv2",
"vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"
},
{
"source": {
"name": "nvd"
},
"score": 8.8,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 5.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
787
],
"description": "An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2021-39537"
},
{
"url": "http://cvsweb.netbsd.org/bsdweb.cgi/pkgsrc/devel/ncurses/patches/patch-ncurses_tinfo_captoinfo.c?rev=1.1&content-type=text/x-cvsweb-markup"
},
{
"url": "http://seclists.org/fulldisclosure/2022/Oct/28"
},
{
"url": "http://seclists.org/fulldisclosure/2022/Oct/41"
},
{
"url": "http://seclists.org/fulldisclosure/2022/Oct/43"
},
{
"url": "http://seclists.org/fulldisclosure/2022/Oct/45"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2021-39537"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2023/12/msg00004.html"
},
{
"url": "https://lists.gnu.org/archive/html/bug-ncurses/2020-08/msg00006.html"
},
{
"url": "https://lists.gnu.org/archive/html/bug-ncurses/2021-10/msg00023.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39537"
},
{
"url": "https://security.netapp.com/advisory/ntap-20230427-0012/"
},
{
"url": "https://support.apple.com/kb/HT213443"
},
{
"url": "https://support.apple.com/kb/HT213444"
},
{
"url": "https://support.apple.com/kb/HT213488"
},
{
"url": "https://ubuntu.com/security/notices/USN-5477-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-6099-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2021-39537"
}
],
"published": "2021-09-20T16:15:12+00:00",
"updated": "2024-11-21T06:19:38+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "6.1-10.20180224.el8",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "6.1-10.20180224.el8",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2021-3997",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
674
],
"description": "A flaw was found in systemd. An uncontrolled recursion in systemd-tmpfiles may lead to a denial of service at boot time when too many nested directories are created in /tmp.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2021-3997"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2021-3997"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2024639"
},
{
"url": "https://github.com/systemd/systemd/commit/5b1cf7a9be37e20133c0208005274ce4a5b5c6a1"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3997"
},
{
"url": "https://security.gentoo.org/glsa/202305-15"
},
{
"url": "https://ubuntu.com/security/notices/USN-5226-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3997"
},
{
"url": "https://www.openwall.com/lists/oss-security/2022/01/10/2"
}
],
"published": "2022-08-23T20:15:08+00:00",
"updated": "2024-11-21T06:23:20+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "239-82.el8_10.16",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "239-82.el8_10.16",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "239-82.el8_10.16",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2021-4209",
"ratings": [
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 6.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
476
],
"description": "A NULL pointer dereference flaw was found in GnuTLS. As Nettle's hash update functions internally call memcpy, providing zero-length input may cause undefined behavior. This flaw leads to a denial of service after authentication in rare circumstances.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2021-4209"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2021-4209"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2044156"
},
{
"url": "https://gitlab.com/gnutls/gnutls/-/commit/3db352734472d851318944db13be73da61300568"
},
{
"url": "https://gitlab.com/gnutls/gnutls/-/issues/1306"
},
{
"url": "https://gitlab.com/gnutls/gnutls/-/merge_requests/1503"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4209"
},
{
"url": "https://security.netapp.com/advisory/ntap-20220915-0005/"
},
{
"url": "https://ubuntu.com/security/notices/USN-5550-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-5750-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2021-4209"
}
],
"published": "2022-08-24T16:15:09+00:00",
"updated": "2024-11-21T06:37:09+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.16-8.el8_10.6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2022-27943",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "low"
},
{
"source": {
"name": "nvd"
},
"score": 4.3,
"severity": "medium",
"method": "CVSSv2",
"vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
},
{
"source": {
"name": "nvd"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 5.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
674
],
"description": "libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2022-27943"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2022-27943"
},
{
"url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039"
},
{
"url": "https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=1a770b01ef415e114164b6151d1e55acdee09371"
},
{
"url": "https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=9234cdca6ee88badfc00297e72f13dac4e540c79"
},
{
"url": "https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=fc968115a742d9e4674d9725ce9c2106b91b6ead"
},
{
"url": "https://gcc.gnu.org/pipermail/gcc-patches/2022-March/592244.html"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27943"
},
{
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=28995"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27943"
}
],
"published": "2022-03-26T13:15:07+00:00",
"updated": "2024-11-21T06:56:31+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "8.5.0-28.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "8.5.0-28.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2022-3219",
"ratings": [
{
"source": {
"name": "nvd"
},
"score": 3.3,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "redhat"
},
"score": 6.2,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"cwes": [
787
],
"description": "GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2022-3219"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2022-3219"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2127010"
},
{
"url": "https://dev.gnupg.org/D556"
},
{
"url": "https://dev.gnupg.org/T5993"
},
{
"url": "https://marc.info/?l=oss-security&m=165696590211434&w=4"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3219"
},
{
"url": "https://security.netapp.com/advisory/ntap-20230324-0001/"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3219"
}
],
"published": "2023-02-23T20:15:12+00:00",
"updated": "2025-03-12T21:15:38+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.2.20-4.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2022-41409",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "low"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "high"
},
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 5.3,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
190
],
"description": "Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2022-41409"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2022-41409"
},
{
"url": "https://github.com/PCRE2Project/pcre2/commit/94e1c001761373b7d9450768aa15d04c25547a35"
},
{
"url": "https://github.com/PCRE2Project/pcre2/issues/141"
},
{
"url": "https://github.com/advisories/GHSA-4qfx-v7wh-3q4j"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41409"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41409"
}
],
"published": "2023-07-18T14:15:12+00:00",
"updated": "2024-11-21T07:23:10+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "10.32-3.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2022-4899",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "high"
},
{
"source": {
"name": "ghsa"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "medium"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 7.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "rocky"
},
"severity": "medium"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
400
],
"description": "A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2022-4899"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:1141"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2022-4899"
},
{
"url": "https://bugzilla.redhat.com/2179864"
},
{
"url": "https://bugzilla.redhat.com/2188109"
},
{
"url": "https://bugzilla.redhat.com/2188113"
},
{
"url": "https://bugzilla.redhat.com/2188115"
},
{
"url": "https://bugzilla.redhat.com/2188116"
},
{
"url": "https://bugzilla.redhat.com/2188117"
},
{
"url": "https://bugzilla.redhat.com/2188118"
},
{
"url": "https://bugzilla.redhat.com/2188119"
},
{
"url": "https://bugzilla.redhat.com/2188120"
},
{
"url": "https://bugzilla.redhat.com/2188121"
},
{
"url": "https://bugzilla.redhat.com/2188122"
},
{
"url": "https://bugzilla.redhat.com/2188123"
},
{
"url": "https://bugzilla.redhat.com/2188124"
},
{
"url": "https://bugzilla.redhat.com/2188125"
},
{
"url": "https://bugzilla.redhat.com/2188127"
},
{
"url": "https://bugzilla.redhat.com/2188128"
},
{
"url": "https://bugzilla.redhat.com/2188129"
},
{
"url": "https://bugzilla.redhat.com/2188130"
},
{
"url": "https://bugzilla.redhat.com/2188131"
},
{
"url": "https://bugzilla.redhat.com/2188132"
},
{
"url": "https://bugzilla.redhat.com/2224211"
},
{
"url": "https://bugzilla.redhat.com/2224212"
},
{
"url": "https://bugzilla.redhat.com/2224213"
},
{
"url": "https://bugzilla.redhat.com/2224214"
},
{
"url": "https://bugzilla.redhat.com/2224215"
},
{
"url": "https://bugzilla.redhat.com/2224216"
},
{
"url": "https://bugzilla.redhat.com/2224217"
},
{
"url": "https://bugzilla.redhat.com/2224218"
},
{
"url": "https://bugzilla.redhat.com/2224219"
},
{
"url": "https://bugzilla.redhat.com/2224220"
},
{
"url": "https://bugzilla.redhat.com/2224221"
},
{
"url": "https://bugzilla.redhat.com/2224222"
},
{
"url": "https://bugzilla.redhat.com/2245014"
},
{
"url": "https://bugzilla.redhat.com/2245015"
},
{
"url": "https://bugzilla.redhat.com/2245016"
},
{
"url": "https://bugzilla.redhat.com/2245017"
},
{
"url": "https://bugzilla.redhat.com/2245018"
},
{
"url": "https://bugzilla.redhat.com/2245019"
},
{
"url": "https://bugzilla.redhat.com/2245020"
},
{
"url": "https://bugzilla.redhat.com/2245021"
},
{
"url": "https://bugzilla.redhat.com/2245022"
},
{
"url": "https://bugzilla.redhat.com/2245023"
},
{
"url": "https://bugzilla.redhat.com/2245024"
},
{
"url": "https://bugzilla.redhat.com/2245026"
},
{
"url": "https://bugzilla.redhat.com/2245027"
},
{
"url": "https://bugzilla.redhat.com/2245028"
},
{
"url": "https://bugzilla.redhat.com/2245029"
},
{
"url": "https://bugzilla.redhat.com/2245030"
},
{
"url": "https://bugzilla.redhat.com/2245031"
},
{
"url": "https://bugzilla.redhat.com/2245032"
},
{
"url": "https://bugzilla.redhat.com/2245033"
},
{
"url": "https://bugzilla.redhat.com/2245034"
},
{
"url": "https://bugzilla.redhat.com/2258771"
},
{
"url": "https://bugzilla.redhat.com/2258772"
},
{
"url": "https://bugzilla.redhat.com/2258773"
},
{
"url": "https://bugzilla.redhat.com/2258774"
},
{
"url": "https://bugzilla.redhat.com/2258775"
},
{
"url": "https://bugzilla.redhat.com/2258776"
},
{
"url": "https://bugzilla.redhat.com/2258777"
},
{
"url": "https://bugzilla.redhat.com/2258778"
},
{
"url": "https://bugzilla.redhat.com/2258779"
},
{
"url": "https://bugzilla.redhat.com/2258780"
},
{
"url": "https://bugzilla.redhat.com/2258781"
},
{
"url": "https://bugzilla.redhat.com/2258782"
},
{
"url": "https://bugzilla.redhat.com/2258783"
},
{
"url": "https://bugzilla.redhat.com/2258784"
},
{
"url": "https://bugzilla.redhat.com/2258785"
},
{
"url": "https://bugzilla.redhat.com/2258787"
},
{
"url": "https://bugzilla.redhat.com/2258788"
},
{
"url": "https://bugzilla.redhat.com/2258789"
},
{
"url": "https://bugzilla.redhat.com/2258790"
},
{
"url": "https://bugzilla.redhat.com/2258791"
},
{
"url": "https://bugzilla.redhat.com/2258792"
},
{
"url": "https://bugzilla.redhat.com/2258793"
},
{
"url": "https://bugzilla.redhat.com/2258794"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2179864"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188109"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188113"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188115"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188116"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188117"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188118"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188119"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188120"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188121"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188122"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188123"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188124"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188125"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188127"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188128"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188129"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188130"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188131"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188132"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2224211"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2224212"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2224213"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2224214"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2224215"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2224216"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2224217"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2224218"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2224219"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2224220"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2224221"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2224222"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245014"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245015"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245016"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245017"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245018"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245019"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245020"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245021"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245022"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245023"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245024"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245026"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245027"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245028"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245029"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245030"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245031"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245032"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245033"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245034"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258771"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258772"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258773"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258774"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258775"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258776"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258777"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258778"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258779"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258780"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258781"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258782"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258783"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258784"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258785"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258787"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258788"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258789"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258790"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258791"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258792"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258793"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258794"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4899"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21911"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21919"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21920"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21929"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21933"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21935"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21940"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21945"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21946"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21947"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21953"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21955"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21962"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21966"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21972"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21976"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21977"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21980"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21982"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22005"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22007"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22008"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22032"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22033"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22038"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22046"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22048"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22053"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22054"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22056"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22057"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22058"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22059"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22064"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22065"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22066"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22068"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22070"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22078"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22079"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22084"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22092"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22097"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22103"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22104"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22110"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22111"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22112"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22113"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22114"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22115"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20960"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20961"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20962"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20963"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20964"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20965"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20966"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20967"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20968"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20969"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20970"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20971"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20972"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20973"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20974"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20976"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20977"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20978"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20981"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20982"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20983"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20984"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20985"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20993"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21049"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21050"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21051"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21052"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21053"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21055"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21056"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21057"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21061"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21137"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21200"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2024-1141.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2024:0894"
},
{
"url": "https://github.com/facebook/zstd"
},
{
"url": "https://github.com/facebook/zstd/issues/3200"
},
{
"url": "https://github.com/facebook/zstd/pull/3220"
},
{
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/zstd/PYSEC-2023-121.yaml"
},
{
"url": "https://github.com/sergey-dryabzhinsky/python-zstd/commit/c8a619aebdbd6b838fbfef6e19325a70f631a4c6"
},
{
"url": "https://linux.oracle.com/cve/CVE-2022-4899.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2024-1141.html"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C63HAGVLQA6FJNDCHR7CNZZL6VSLILB2/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JEHRBBYYTPA4DETOM5XAKGCP37NUTLOA/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QYLDK6ODVC4LJSDULLX6Q2YHTFOWABCN/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/C63HAGVLQA6FJNDCHR7CNZZL6VSLILB2"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JEHRBBYYTPA4DETOM5XAKGCP37NUTLOA"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QYLDK6ODVC4LJSDULLX6Q2YHTFOWABCN"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4899"
},
{
"url": "https://security.netapp.com/advisory/ntap-20230725-0005"
},
{
"url": "https://security.netapp.com/advisory/ntap-20230725-0005/"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2022-4899"
}
],
"published": "2023-03-31T20:15:07+00:00",
"updated": "2025-02-18T18:15:14+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.4.4-1.el8",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2023-0464",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "high"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "high"
},
{
"source": {
"name": "julia"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "medium"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 5.9,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
295
],
"description": "A security vulnerability has been identified in all supported versions\n\nof OpenSSL related to the verification of X.509 certificate chains\nthat include policy constraints. Attackers may be able to exploit this\nvulnerability by creating a malicious certificate chain that triggers\nexponential use of computational resources, leading to a denial-of-service\n(DoS) attack on affected systems.\n\nPolicy processing is disabled by default but can be enabled by passing\nthe `-policy' argument to the command line utilities or by calling the\n`X509_VERIFY_PARAM_set1_policies()' function.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2023-0464"
},
{
"url": "https://access.redhat.com/errata/RHSA-2023:3722"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2023-0464"
},
{
"url": "https://bugzilla.redhat.com/2181082"
},
{
"url": "https://bugzilla.redhat.com/2182561"
},
{
"url": "https://bugzilla.redhat.com/2182565"
},
{
"url": "https://bugzilla.redhat.com/2188461"
},
{
"url": "https://bugzilla.redhat.com/2207947"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2023-3722.html"
},
{
"url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2017771e2db3e2b96f89bbe8766c3209f6a99545"
},
{
"url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2dcd4f1e3115f38cefa43e3efbe9b801c27e642e"
},
{
"url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=879f7080d7e141f415c79eaa3a8ac4a3dad0348b"
},
{
"url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=959c59c7a0164117e7f8366466a32bb1f8d77ff1"
},
{
"url": "https://github.com/advisories/GHSA-w2w6-xp88-5cvw"
},
{
"url": "https://linux.oracle.com/cve/CVE-2023-0464.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2023-3722.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0464"
},
{
"url": "https://security.gentoo.org/glsa/202402-08"
},
{
"url": "https://security.netapp.com/advisory/ntap-20230406-0006"
},
{
"url": "https://security.netapp.com/advisory/ntap-20230406-0006/"
},
{
"url": "https://security.netapp.com/advisory/ntap-20240621-0006"
},
{
"url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
},
{
"url": "https://ubuntu.com/security/notices/USN-6039-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7894-1"
},
{
"url": "https://www.couchbase.com/alerts"
},
{
"url": "https://www.couchbase.com/alerts/"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0464"
},
{
"url": "https://www.debian.org/security/2023/dsa-5417"
},
{
"url": "https://www.openssl.org/news/secadv/20230322.txt"
}
],
"published": "2023-03-22T17:15:13+00:00",
"updated": "2025-05-05T16:15:26+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2023-0465",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "julia"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
{
"source": {
"name": "nvd"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "medium"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.3,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
295
],
"description": "Applications that use a non-default option when verifying certificates may be\nvulnerable to an attack from a malicious CA to circumvent certain checks.\n\nInvalid certificate policies in leaf certificates are silently ignored by\nOpenSSL and other certificate policy checks are skipped for that certificate.\nA malicious CA could use this to deliberately assert invalid certificate policies\nin order to circumvent policy checking on the certificate altogether.\n\nPolicy processing is disabled by default but can be enabled by passing\nthe `-policy' argument to the command line utilities or by calling the\n`X509_VERIFY_PARAM_set1_policies()' function.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2023-0465"
},
{
"url": "https://access.redhat.com/errata/RHSA-2023:3722"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2023-0465"
},
{
"url": "https://bugzilla.redhat.com/2181082"
},
{
"url": "https://bugzilla.redhat.com/2182561"
},
{
"url": "https://bugzilla.redhat.com/2182565"
},
{
"url": "https://bugzilla.redhat.com/2188461"
},
{
"url": "https://bugzilla.redhat.com/2207947"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2023-3722.html"
},
{
"url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=10325176f3d3e98c6e2b3bf5ab1e3b334de6947a"
},
{
"url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1dd43e0709fece299b15208f36cc7c76209ba0bb"
},
{
"url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=b013765abfa80036dc779dd0e50602c57bb3bf95"
},
{
"url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=facfb1ab745646e97a1920977ae4a9965ea61d5c"
},
{
"url": "https://github.com/advisories/GHSA-77f3-6546-6rj7"
},
{
"url": "https://linux.oracle.com/cve/CVE-2023-0465.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2023-3722.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0465"
},
{
"url": "https://security.gentoo.org/glsa/202402-08"
},
{
"url": "https://security.netapp.com/advisory/ntap-20230414-0001"
},
{
"url": "https://security.netapp.com/advisory/ntap-20230414-0001/"
},
{
"url": "https://ubuntu.com/security/notices/USN-6039-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7894-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0465"
},
{
"url": "https://www.debian.org/security/2023/dsa-5417"
},
{
"url": "https://www.openssl.org/news/secadv/20230328.txt"
}
],
"published": "2023-03-28T15:15:06+00:00",
"updated": "2025-02-18T21:15:13+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2023-0466",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "julia"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
{
"source": {
"name": "nvd"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "medium"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
295
],
"description": "The function X509_VERIFY_PARAM_add0_policy() is documented to\nimplicitly enable the certificate policy check when doing certificate\nverification. However the implementation of the function does not\nenable the check which allows certificates with invalid or incorrect\npolicies to pass the certificate verification.\n\nAs suddenly enabling the policy check could break existing deployments it was\ndecided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy()\nfunction.\n\nInstead the applications that require OpenSSL to perform certificate\npolicy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly\nenable the policy check by calling X509_VERIFY_PARAM_set_flags() with\nthe X509_V_FLAG_POLICY_CHECK flag argument.\n\nCertificate policy checks are disabled by default in OpenSSL and are not\ncommonly used by applications.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2023-0466"
},
{
"url": "http://www.openwall.com/lists/oss-security/2023/09/28/4"
},
{
"url": "https://access.redhat.com/errata/RHSA-2023:3722"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2023-0466"
},
{
"url": "https://bugzilla.redhat.com/2181082"
},
{
"url": "https://bugzilla.redhat.com/2182561"
},
{
"url": "https://bugzilla.redhat.com/2182565"
},
{
"url": "https://bugzilla.redhat.com/2188461"
},
{
"url": "https://bugzilla.redhat.com/2207947"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2023-3722.html"
},
{
"url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=0d16b7e99aafc0b4a6d729eec65a411a7e025f0a"
},
{
"url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=51e8a84ce742db0f6c70510d0159dad8f7825908"
},
{
"url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=73398dea26de9899fb4baa94098ad0a61f435c72"
},
{
"url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc814a30fc4f0bc54fcea7d9a7462f5457aab061"
},
{
"url": "https://github.com/advisories/GHSA-pxvj-4wx4-gv6w"
},
{
"url": "https://linux.oracle.com/cve/CVE-2023-0466.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2023-3722.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0466"
},
{
"url": "https://security.gentoo.org/glsa/202402-08"
},
{
"url": "https://security.netapp.com/advisory/ntap-20230414-0001"
},
{
"url": "https://security.netapp.com/advisory/ntap-20230414-0001/"
},
{
"url": "https://ubuntu.com/security/notices/USN-6039-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7894-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0466"
},
{
"url": "https://www.debian.org/security/2023/dsa-5417"
},
{
"url": "https://www.openssl.org/news/secadv/20230328.txt"
}
],
"published": "2023-03-28T15:15:06+00:00",
"updated": "2025-02-19T18:15:22+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2023-2650",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "julia"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "nvd"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "medium"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 6.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
770
],
"description": "Issue summary: Processing some specially crafted ASN.1 object identifiers or\ndata containing them may be very slow.\n\nImpact summary: Applications that use OBJ_obj2txt() directly, or use any of\nthe OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message\nsize limit may experience notable to very long delays when processing those\nmessages, which may lead to a Denial of Service.\n\nAn OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers -\nmost of which have no size limit. OBJ_obj2txt() may be used to translate\nan ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL\ntype ASN1_OBJECT) to its canonical numeric text form, which are the\nsub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by\nperiods.\n\nWhen one of the sub-identifiers in the OBJECT IDENTIFIER is very large\n(these are sizes that are seen as absurdly large, taking up tens or hundreds\nof KiBs), the translation to a decimal number in text may take a very long\ntime. The time complexity is O(n^2) with 'n' being the size of the\nsub-identifiers in bytes (*).\n\nWith OpenSSL 3.0, support to fetch cryptographic algorithms using names /\nidentifiers in string form was introduced. This includes using OBJECT\nIDENTIFIERs in canonical numeric text form as identifiers for fetching\nalgorithms.\n\nSuch OBJECT IDENTIFIERs may be received through the ASN.1 structure\nAlgorithmIdentifier, which is commonly used in multiple protocols to specify\nwhat cryptographic algorithm should be used to sign or verify, encrypt or\ndecrypt, or digest passed data.\n\nApplications that call OBJ_obj2txt() directly with untrusted data are\naffected, with any version of OpenSSL. If the use is for the mere purpose\nof display, the severity is considered low.\n\nIn OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME,\nCMS, CMP/CRMF or TS. It also impacts anything that processes X.509\ncertificates, including simple things like verifying its signature.\n\nThe impact on TLS is relatively low, because all versions of OpenSSL have a\n100KiB limit on the peer's certificate chain. Additionally, this only\nimpacts clients, or servers that have explicitly enabled client\nauthentication.\n\nIn OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects,\nsuch as X.509 certificates. This is assumed to not happen in such a way\nthat it would cause a Denial of Service, so these versions are considered\nnot affected by this issue in such a way that it would be cause for concern,\nand the severity is therefore considered low.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2023-2650"
},
{
"url": "http://www.openwall.com/lists/oss-security/2023/05/30/1"
},
{
"url": "https://access.redhat.com/errata/RHSA-2023:6330"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2023-2650"
},
{
"url": "https://bugzilla.redhat.com/1858038"
},
{
"url": "https://bugzilla.redhat.com/2207947"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2023-6330.html"
},
{
"url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=423a2bc737a908ad0c77bda470b2b59dc879936b"
},
{
"url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=853c5e56ee0b8650c73140816bb8b91d6163422c"
},
{
"url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9e209944b35cf82368071f160a744b6178f9b098"
},
{
"url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=db779b0e10b047f2585615e0b8f2acdf21f8544a"
},
{
"url": "https://github.com/advisories/GHSA-gqxg-9vfr-p9cg"
},
{
"url": "https://linux.oracle.com/cve/CVE-2023-2650.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2023-6330.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2650"
},
{
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0009"
},
{
"url": "https://security.gentoo.org/glsa/202402-08"
},
{
"url": "https://security.netapp.com/advisory/ntap-20230703-0001/"
},
{
"url": "https://security.netapp.com/advisory/ntap-20231027-0009/"
},
{
"url": "https://ubuntu.com/security/notices/USN-6119-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-6188-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-6672-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7894-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2023-2650"
},
{
"url": "https://www.debian.org/security/2023/dsa-5417"
},
{
"url": "https://www.openssl.org/news/secadv/20230530.txt"
}
],
"published": "2023-05-30T14:15:09+00:00",
"updated": "2025-03-19T16:15:21+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2023-27534",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "high"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "high"
},
{
"source": {
"name": "nvd"
},
"score": 8.8,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "medium"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 3.7,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
22
],
"description": "A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a server with a specific user.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2023-27534"
},
{
"url": "https://access.redhat.com/errata/RHSA-2023:6679"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2023-27534"
},
{
"url": "https://bugzilla.redhat.com/2179062"
},
{
"url": "https://bugzilla.redhat.com/2179069"
},
{
"url": "https://bugzilla.redhat.com/2179092"
},
{
"url": "https://bugzilla.redhat.com/2179103"
},
{
"url": "https://curl.se/docs/CVE-2023-27534.html"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2023-6679.html"
},
{
"url": "https://hackerone.com/reports/1892351"
},
{
"url": "https://linux.oracle.com/cve/CVE-2023-27534.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2023-6679.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00016.html"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36NBD5YLJXXEDZLDGNFCERWRYJQ6LAQW/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27534"
},
{
"url": "https://security.gentoo.org/glsa/202310-12"
},
{
"url": "https://security.netapp.com/advisory/ntap-20230420-0012/"
},
{
"url": "https://ubuntu.com/security/notices/USN-5964-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27534"
}
],
"published": "2023-03-30T20:15:07+00:00",
"updated": "2025-04-23T17:16:28+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.11",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.11",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2023-29499",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "low"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "low"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 6.2,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
400
],
"description": "A flaw was found in GLib. GVariant deserialization fails to validate that the input conforms to the expected format, leading to denial of service.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2023-29499"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:2528"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2023-29499"
},
{
"url": "https://bugzilla.redhat.com/2211827"
},
{
"url": "https://bugzilla.redhat.com/2211828"
},
{
"url": "https://bugzilla.redhat.com/2211829"
},
{
"url": "https://bugzilla.redhat.com/2211833"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2211828"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2024-2528.html"
},
{
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/2794"
},
{
"url": "https://linux.oracle.com/cve/CVE-2023-29499.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2024-2528.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00030.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29499"
},
{
"url": "https://security.gentoo.org/glsa/202311-18"
},
{
"url": "https://security.netapp.com/advisory/ntap-20231103-0001/"
},
{
"url": "https://ubuntu.com/security/notices/USN-6165-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-6165-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29499"
}
],
"published": "2023-09-14T20:15:09+00:00",
"updated": "2024-11-21T07:57:10+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.56.4-169.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2023-32611",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "low"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "low"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 6.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
400
],
"description": "A flaw was found in GLib. GVariant deserialization is vulnerable to a slowdown issue where a crafted GVariant can cause excessive processing, leading to denial of service.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2023-32611"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:2528"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2023-32611"
},
{
"url": "https://bugzilla.redhat.com/2211827"
},
{
"url": "https://bugzilla.redhat.com/2211828"
},
{
"url": "https://bugzilla.redhat.com/2211829"
},
{
"url": "https://bugzilla.redhat.com/2211833"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2211829"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2024-2528.html"
},
{
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/2797"
},
{
"url": "https://linux.oracle.com/cve/CVE-2023-32611.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2024-2528.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00030.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32611"
},
{
"url": "https://security.gentoo.org/glsa/202311-18"
},
{
"url": "https://security.netapp.com/advisory/ntap-20231027-0005/"
},
{
"url": "https://ubuntu.com/security/notices/USN-6165-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-6165-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2023-32611"
}
],
"published": "2023-09-14T20:15:09+00:00",
"updated": "2024-11-21T08:03:41+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.56.4-169.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2023-32636",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "low"
},
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "high"
},
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "low"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 6.2,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
400,
502
],
"description": "A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resolve CVE-2023-29499. The offset table validation may be very slow. This bug does not affect any released version of glib but does affect glib distributors who followed the guidance of glib developers to backport the initial fix for CVE-2023-29499.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2023-32636"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:2528"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2023-32636"
},
{
"url": "https://bugzilla.redhat.com/2211827"
},
{
"url": "https://bugzilla.redhat.com/2211828"
},
{
"url": "https://bugzilla.redhat.com/2211829"
},
{
"url": "https://bugzilla.redhat.com/2211833"
},
{
"url": "https://discourse.gnome.org/t/multiple-fixes-for-gvariant-normalisation-issues-in-glib/12835"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2024-2528.html"
},
{
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/2841"
},
{
"url": "https://https://discourse.gnome.org/t/multiple-fixes-for-gvariant-normalisation-issues-in-glib/12835"
},
{
"url": "https://linux.oracle.com/cve/CVE-2023-32636.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2024-2528.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32636"
},
{
"url": "https://security.netapp.com/advisory/ntap-20231110-0002/"
},
{
"url": "https://ubuntu.com/security/notices/USN-6165-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-6165-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2023-32636"
}
],
"published": "2023-09-14T20:15:09+00:00",
"updated": "2024-11-21T08:03:44+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.56.4-169.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2023-32665",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "low"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "low"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 6.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
400,
502
],
"description": "A flaw was found in GLib. GVariant deserialization is vulnerable to an exponential blowup issue where a crafted GVariant can cause excessive processing, leading to denial of service.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2023-32665"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:2528"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2023-32665"
},
{
"url": "https://bugzilla.redhat.com/2211827"
},
{
"url": "https://bugzilla.redhat.com/2211828"
},
{
"url": "https://bugzilla.redhat.com/2211829"
},
{
"url": "https://bugzilla.redhat.com/2211833"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2211827"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2024-2528.html"
},
{
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/2121"
},
{
"url": "https://linux.oracle.com/cve/CVE-2023-32665.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2024-2528.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00030.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32665"
},
{
"url": "https://security.gentoo.org/glsa/202311-18"
},
{
"url": "https://security.netapp.com/advisory/ntap-20240426-0006/"
},
{
"url": "https://ubuntu.com/security/notices/USN-6165-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-6165-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2023-32665"
}
],
"published": "2023-09-14T20:15:09+00:00",
"updated": "2024-11-21T08:03:48+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.56.4-169.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2023-39804",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "low"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 3.3,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"description": "In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2023-39804"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2023-39804"
},
{
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1058079"
},
{
"url": "https://git.savannah.gnu.org/cgit/tar.git/commit/?id=a339f05cd269013fa133d2f148d73f6f7d4247e4"
},
{
"url": "https://git.savannah.gnu.org/cgit/tar.git/tree/src/xheader.c?h=release_1_34#n1723"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00008.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39804"
},
{
"url": "https://ubuntu.com/security/notices/USN-6543-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2023-39804"
}
],
"published": "2024-03-27T04:15:08+00:00",
"updated": "2025-11-04T19:15:55+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2",
"versions": [
{
"version": "2:1.30-11.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2023-4156",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "low"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "high"
},
{
"source": {
"name": "nvd"
},
"score": 7.1,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 6.1,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
125
],
"description": "A heap out-of-bounds read flaw was found in builtin.c in the gawk package. This issue may lead to a crash and could be used to read sensitive information.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2023-4156"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2023-4156"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215930"
},
{
"url": "https://git.savannah.gnu.org/gitweb/?p=gawk.git;a=commitdiff;h=e709eb829448ce040087a3fc5481db6bfcaae212"
},
{
"url": "https://mail.gnu.org/archive/html/bug-gawk/2022-08/msg00000.html"
},
{
"url": "https://mail.gnu.org/archive/html/bug-gawk/2022-08/msg00023.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4156"
},
{
"url": "https://ubuntu.com/security/notices/USN-6373-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2023-4156"
}
],
"published": "2023-09-25T18:15:11+00:00",
"updated": "2024-11-21T08:34:30+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "4.2.1-4.el8",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2023-45322",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.9,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"cwes": [
416
],
"description": "libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is \"I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when memory allocations fail.\"",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2023-45322"
},
{
"url": "http://www.openwall.com/lists/oss-security/2023/10/06/5"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2023-45322"
},
{
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/344"
},
{
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/583"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45322"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45322"
}
],
"published": "2023-10-06T22:15:11+00:00",
"updated": "2025-11-03T21:16:01+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.9.7-21.el8_10.4",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2023-45803",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "ghsa"
},
"score": 4.2,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "nvd"
},
"score": 4.2,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "medium"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 4.2,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "rocky"
},
"severity": "medium"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
200
],
"description": "urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body (like `POST`) to `GET` as is required by HTTP RFCs. Although this behavior is not specified in the section for redirects, it can be inferred by piecing together information from different sections and we have observed the behavior in other major HTTP client implementations like curl and web browsers. Because the vulnerability requires a previously trusted service to become compromised in order to have an impact on confidentiality we believe the exploitability of this vulnerability is low. Additionally, many users aren't putting sensitive data in HTTP request bodies, if this is the case then this vulnerability isn't exploitable. Both of the following conditions must be true to be affected by this vulnerability: 1. Using urllib3 and submitting sensitive information in the HTTP request body (such as form data or JSON) and 2. The origin service is compromised and starts redirecting using 301, 302, or 303 to a malicious peer or the redirected-to service becomes compromised. This issue has been addressed in versions 1.26.18 and 2.0.7 and users are advised to update to resolve this issue. Users unable to update should disable redirects for services that aren't expecting to respond with redirects with `redirects=False` and disable automatic redirects with `redirects=False` and handle 301, 302, and 303 redirects manually by stripping the HTTP request body.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2023-45803"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:2132"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2023-45803"
},
{
"url": "https://bugzilla.redhat.com/2246840"
},
{
"url": "https://bugzilla.redhat.com/2257028"
},
{
"url": "https://bugzilla.redhat.com/2257854"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2246840"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45803"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2024-2132.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2024:11238"
},
{
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2023-212.yaml"
},
{
"url": "https://github.com/urllib3/urllib3"
},
{
"url": "https://github.com/urllib3/urllib3/commit/4e50fbc5db74e32cabd5ccc1ab81fc103adfe0b3"
},
{
"url": "https://github.com/urllib3/urllib3/commit/4e98d57809dacab1cbe625fddeec1a290c478ea9"
},
{
"url": "https://github.com/urllib3/urllib3/commit/b594c5ceaca38e1ac215f916538fb128e3526a36"
},
{
"url": "https://github.com/urllib3/urllib3/releases/tag/1.26.18"
},
{
"url": "https://github.com/urllib3/urllib3/releases/tag/2.0.7"
},
{
"url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-g4mx-q9vg-27p4"
},
{
"url": "https://linux.oracle.com/cve/CVE-2023-45803.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2024-2988.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00020.html"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4R2Y5XK3WALSR3FNAGN7JBYV2B343ZKB"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4R2Y5XK3WALSR3FNAGN7JBYV2B343ZKB/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5F5CUBAN5XMEBVBZPHFITBLMJV5FIJJ5"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5F5CUBAN5XMEBVBZPHFITBLMJV5FIJJ5/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PPDPLM6UUMN55ESPQWJFLLIZY4ZKCNRX"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PPDPLM6UUMN55ESPQWJFLLIZY4ZKCNRX/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45803"
},
{
"url": "https://ubuntu.com/security/notices/USN-6473-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-6473-2"
},
{
"url": "https://ubuntu.com/security/notices/USN-7762-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45803"
},
{
"url": "https://www.rfc-editor.org/rfc/rfc9110.html#name-get"
}
],
"published": "2023-10-17T20:15:10+00:00",
"updated": "2025-11-03T22:16:28+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "9.0.3-24.el8",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "9.0.3-24.el8",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
}
]
},
{
"id": "CVE-2023-50495",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 6.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"description": "NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry().",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2023-50495"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2023-50495"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/"
},
{
"url": "https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00020.html"
},
{
"url": "https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00029.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50495"
},
{
"url": "https://security.netapp.com/advisory/ntap-20240119-0008/"
},
{
"url": "https://ubuntu.com/security/notices/USN-6684-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2023-50495"
}
],
"published": "2023-12-12T15:15:07+00:00",
"updated": "2025-11-04T19:16:14+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "6.1-10.20180224.el8",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "6.1-10.20180224.el8",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2024-0232",
"ratings": [
{
"source": {
"name": "bitnami"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "nvd"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 4.7,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H"
}
],
"cwes": [
416
],
"description": "A heap use-after-free issue has been identified in SQLite in the jsonParseAddNodeArray() function in sqlite3.c. This flaw allows a local attacker to leverage a victim to pass specially crafted malicious input to the application, potentially causing a crash and leading to a denial of service.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2024-0232"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-0232"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2243754"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDCMYQ3J45NHQ4EJREM3BJNNKB5BK4Y7/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0232"
},
{
"url": "https://security.netapp.com/advisory/ntap-20240315-0007/"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2024-0232"
}
],
"published": "2024-01-16T14:15:48+00:00",
"updated": "2024-11-21T08:46:06+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.26.0-20.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2024-0397",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "high"
},
{
"source": {
"name": "bitnami"
},
"score": 7.4,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
362
],
"description": "A defect was discovered in the Python \u201cssl\u201d module where there is a memory\nrace condition with the ssl.SSLContext methods \u201ccert_store_stats()\u201d and\n\u201cget_ca_certs()\u201d. The race condition can be triggered if the methods are\ncalled at the same time as certificates are loaded into the SSLContext,\nsuch as during the TLS handshake with a certificate directory configured.\nThis issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2024-0397"
},
{
"url": "http://www.openwall.com/lists/oss-security/2024/06/17/2"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-0397"
},
{
"url": "https://github.com/python/cpython/commit/01c37f1d0714f5822d34063ca7180b595abf589d"
},
{
"url": "https://github.com/python/cpython/commit/29c97287d205bf2f410f4895ebce3f43b5160524"
},
{
"url": "https://github.com/python/cpython/commit/37324b421b72b7bc9934e27aba85d48d4773002e"
},
{
"url": "https://github.com/python/cpython/commit/542f3272f56f31ed04e74c40635a913fbc12d286"
},
{
"url": "https://github.com/python/cpython/commit/b228655c227b2ca298a8ffac44d14ce3d22f6faa"
},
{
"url": "https://github.com/python/cpython/commit/bce693111bff906ccf9281c22371331aaff766ab"
},
{
"url": "https://github.com/python/cpython/commit/bce693111bff906ccf9281c22371331aaff766ab"
},
{
"url": "https://github.com/python/cpython/issues/114572"
},
{
"url": "https://github.com/python/cpython/pull/114573"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"
},
{
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/BMAK5BCGKYWNJOACVUSLUF6SFGBIM4VP/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0397"
},
{
"url": "https://security.netapp.com/advisory/ntap-20250411-0006/"
},
{
"url": "https://ubuntu.com/security/notices/USN-6928-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2024-0397"
}
],
"published": "2024-06-17T16:15:10+00:00",
"updated": "2026-04-15T00:35:42+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-76.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-76.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
}
]
},
{
"id": "CVE-2024-0727",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "ghsa"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "julia"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "nvd"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "medium"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "rocky"
},
"severity": "medium"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
476
],
"description": "Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL\nto crash leading to a potential Denial of Service attack\n\nImpact summary: Applications loading files in the PKCS12 format from untrusted\nsources might terminate abruptly.\n\nA file in PKCS12 format can contain certificates and keys and may come from an\nuntrusted source. The PKCS12 specification allows certain fields to be NULL, but\nOpenSSL does not correctly check for this case. This can lead to a NULL pointer\ndereference that results in OpenSSL crashing. If an application processes PKCS12\nfiles from an untrusted source using the OpenSSL APIs then that application will\nbe vulnerable to this issue.\n\nOpenSSL APIs that are vulnerable to this are: PKCS12_parse(),\nPKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes()\nand PKCS12_newpass().\n\nWe have also fixed a similar issue in SMIME_write_PKCS7(). However since this\nfunction is related to writing data we do not consider it security significant.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2024-0727"
},
{
"url": "http://www.openwall.com/lists/oss-security/2024/03/11/1"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:9088"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-0727"
},
{
"url": "https://bugzilla.redhat.com/2257571"
},
{
"url": "https://bugzilla.redhat.com/2258502"
},
{
"url": "https://bugzilla.redhat.com/2259944"
},
{
"url": "https://bugzilla.redhat.com/2284243"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2257571"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258502"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2259944"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2284243"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-277137.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-331112.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-769027.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-915275.html"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6129"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6237"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-0727"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1298"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2024-9088.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2024:9088"
},
{
"url": "https://github.com/advisories/GHSA-9v9h-cgj8-h64p"
},
{
"url": "https://github.com/alexcrichton/openssl-src-rs/commit/add20f73b6b42be7451af2e1044d4e0e778992b2"
},
{
"url": "https://github.com/github/advisory-database/pull/3472"
},
{
"url": "https://github.com/openssl/openssl/commit/09df4395b5071217b76dc7d3d2e630eb8c5a79c2"
},
{
"url": "https://github.com/openssl/openssl/commit/775acfdbd0c6af9ac855f34969cdab0c0c90844a"
},
{
"url": "https://github.com/openssl/openssl/commit/d135eeab8a5dbf72b3da5240bab9ddb7678dbd2c"
},
{
"url": "https://github.com/openssl/openssl/pull/23362"
},
{
"url": "https://github.com/pyca/cryptography/commit/3519591d255d4506fbcd0d04037d45271903c64d"
},
{
"url": "https://github.openssl.org/openssl/extended-releases/commit/03b3941d60c4bce58fab69a0c22377ab439bc0e8"
},
{
"url": "https://github.openssl.org/openssl/extended-releases/commit/aebaa5883e31122b404e450732dc833dc9dee539"
},
{
"url": "https://linux.oracle.com/cve/CVE-2024-0727.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2024-9088.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0727"
},
{
"url": "https://security.netapp.com/advisory/ntap-20240208-0006"
},
{
"url": "https://security.netapp.com/advisory/ntap-20240208-0006/"
},
{
"url": "https://ubuntu.com/security/notices/USN-6622-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-6632-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-6709-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7018-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7894-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2024-0727"
},
{
"url": "https://www.openssl.org/news/secadv/20240125.txt"
}
],
"published": "2024-01-26T09:15:07+00:00",
"updated": "2026-05-12T12:16:16+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any Python code. That assures that the vulnerable code path in the affected library is not reachable. The Python libraries are only used for diagnostics."
}
},
{
"id": "CVE-2024-10524",
"ratings": [
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "julia"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L"
},
{
"source": {
"name": "redhat"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L"
}
],
"cwes": [
918
],
"description": "Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2024-10524"
},
{
"url": "http://www.openwall.com/lists/oss-security/2024/11/18/6"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-10524"
},
{
"url": "https://git.savannah.gnu.org/cgit/wget.git/commit/?id=c419542d956a2607bbce5df64b9d378a8588d778"
},
{
"url": "https://github.com/advisories/GHSA-mqrm-h2pw-9j9r"
},
{
"url": "https://jfrog.com/blog/cve-2024-10524-wget-zero-day-vulnerability"
},
{
"url": "https://jfrog.com/blog/cve-2024-10524-wget-zero-day-vulnerability/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10524"
},
{
"url": "https://seclists.org/oss-sec/2024/q4/107"
},
{
"url": "https://security.netapp.com/advisory/ntap-20250321-0007"
},
{
"url": "https://security.netapp.com/advisory/ntap-20250321-0007/"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2024-10524"
}
],
"published": "2024-11-19T15:15:06+00:00",
"updated": "2026-04-15T00:35:42+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.19.5-12.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2024-11053",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "high"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "high"
},
{
"source": {
"name": "julia"
},
"score": 3.4,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "low"
},
{
"source": {
"name": "redhat"
},
"score": 5.9,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"description": "When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, curl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.\n\nThis flaw only manifests itself if the netrc file has an entry that matches\nthe redirect target hostname but the entry either omits just the password or\nomits both login and password.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2024-11053"
},
{
"url": "http://www.openwall.com/lists/oss-security/2024/12/11/1"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:1671"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-11053"
},
{
"url": "https://bugzilla.redhat.com/2294581"
},
{
"url": "https://bugzilla.redhat.com/2294676"
},
{
"url": "https://bugzilla.redhat.com/2301888"
},
{
"url": "https://bugzilla.redhat.com/2318857"
},
{
"url": "https://bugzilla.redhat.com/2318858"
},
{
"url": "https://bugzilla.redhat.com/2318870"
},
{
"url": "https://bugzilla.redhat.com/2318873"
},
{
"url": "https://bugzilla.redhat.com/2318874"
},
{
"url": "https://bugzilla.redhat.com/2318876"
},
{
"url": "https://bugzilla.redhat.com/2318882"
},
{
"url": "https://bugzilla.redhat.com/2318883"
},
{
"url": "https://bugzilla.redhat.com/2318884"
},
{
"url": "https://bugzilla.redhat.com/2318885"
},
{
"url": "https://bugzilla.redhat.com/2318886"
},
{
"url": "https://bugzilla.redhat.com/2318897"
},
{
"url": "https://bugzilla.redhat.com/2318900"
},
{
"url": "https://bugzilla.redhat.com/2318905"
},
{
"url": "https://bugzilla.redhat.com/2318914"
},
{
"url": "https://bugzilla.redhat.com/2318922"
},
{
"url": "https://bugzilla.redhat.com/2318923"
},
{
"url": "https://bugzilla.redhat.com/2318925"
},
{
"url": "https://bugzilla.redhat.com/2318926"
},
{
"url": "https://bugzilla.redhat.com/2318927"
},
{
"url": "https://bugzilla.redhat.com/2331191"
},
{
"url": "https://bugzilla.redhat.com/2339218"
},
{
"url": "https://bugzilla.redhat.com/2339220"
},
{
"url": "https://bugzilla.redhat.com/2339221"
},
{
"url": "https://bugzilla.redhat.com/2339226"
},
{
"url": "https://bugzilla.redhat.com/2339231"
},
{
"url": "https://bugzilla.redhat.com/2339236"
},
{
"url": "https://bugzilla.redhat.com/2339238"
},
{
"url": "https://bugzilla.redhat.com/2339243"
},
{
"url": "https://bugzilla.redhat.com/2339247"
},
{
"url": "https://bugzilla.redhat.com/2339252"
},
{
"url": "https://bugzilla.redhat.com/2339259"
},
{
"url": "https://bugzilla.redhat.com/2339266"
},
{
"url": "https://bugzilla.redhat.com/2339270"
},
{
"url": "https://bugzilla.redhat.com/2339271"
},
{
"url": "https://bugzilla.redhat.com/2339275"
},
{
"url": "https://bugzilla.redhat.com/2339277"
},
{
"url": "https://bugzilla.redhat.com/2339281"
},
{
"url": "https://bugzilla.redhat.com/2339284"
},
{
"url": "https://bugzilla.redhat.com/2339291"
},
{
"url": "https://bugzilla.redhat.com/2339293"
},
{
"url": "https://bugzilla.redhat.com/2339295"
},
{
"url": "https://bugzilla.redhat.com/2339299"
},
{
"url": "https://bugzilla.redhat.com/2339300"
},
{
"url": "https://bugzilla.redhat.com/2339304"
},
{
"url": "https://bugzilla.redhat.com/2339305"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2294581"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2294676"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2301888"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318857"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318858"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318870"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318873"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318874"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318876"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318882"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318883"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318884"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318885"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318886"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318897"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318900"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318905"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318914"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318922"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318923"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318925"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318926"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318927"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331191"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339218"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339220"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339221"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339226"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339231"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339236"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339238"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339243"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339247"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339252"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339259"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339266"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339270"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339271"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339275"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339277"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339281"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339284"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339291"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339293"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339295"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339299"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339300"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339304"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339305"
},
{
"url": "https://curl.se/docs/CVE-2024-11053.html"
},
{
"url": "https://curl.se/docs/CVE-2024-11053.json"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-11053"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21193"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21194"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21196"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21197"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21198"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21199"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21201"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21203"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21212"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21213"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21218"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21219"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21230"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21231"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21236"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21237"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21238"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21239"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21241"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21247"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37371"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5535"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7264"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21490"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21491"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21494"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21497"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21500"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21501"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21503"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21504"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21505"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21518"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21519"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21520"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21521"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21522"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21523"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21525"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21529"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21531"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21534"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21536"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21540"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21543"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21546"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21555"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21559"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2025-1671.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2025:1671"
},
{
"url": "https://github.com/advisories/GHSA-h288-5fq8-5pfw"
},
{
"url": "https://hackerone.com/reports/2829063"
},
{
"url": "https://linux.oracle.com/cve/CVE-2024-11053.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2025-1673.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11053"
},
{
"url": "https://security.netapp.com/advisory/ntap-20250124-0012"
},
{
"url": "https://security.netapp.com/advisory/ntap-20250124-0012/"
},
{
"url": "https://security.netapp.com/advisory/ntap-20250131-0003"
},
{
"url": "https://security.netapp.com/advisory/ntap-20250131-0003/"
},
{
"url": "https://security.netapp.com/advisory/ntap-20250131-0004"
},
{
"url": "https://security.netapp.com/advisory/ntap-20250131-0004/"
},
{
"url": "https://ubuntu.com/security/notices/USN-7162-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2024-11053"
},
{
"url": "https://www.oracle.com/security-alerts/cpujan2025.html#AppendixMSQL"
}
],
"published": "2024-12-11T08:15:05+00:00",
"updated": "2025-11-03T21:16:04+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.11",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.11",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
}
]
},
{
"id": "CVE-2024-13176",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "julia"
},
"score": 4.1,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 4.7,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "rocky"
},
"severity": "medium"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
385
],
"description": "Issue summary: A timing side-channel which could potentially allow recovering\nthe private key exists in the ECDSA signature computation.\n\nImpact summary: A timing side-channel in ECDSA signature computations\ncould allow recovering the private key by an attacker. However, measuring\nthe timing would require either local access to the signing application or\na very fast network connection with low latency.\n\nThere is a timing signal of around 300 nanoseconds when the top word of\nthe inverted ECDSA nonce value is zero. This can happen with significant\nprobability only for some of the supported elliptic curves. In particular\nthe NIST P-521 curve is affected. To be able to measure this leak, the attacker\nprocess must either be located in the same physical computer or must\nhave a very fast network connection with low latency. For that reason\nthe severity of this vulnerability is Low.\n\nThe FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2024-13176"
},
{
"url": "http://www.openwall.com/lists/oss-security/2025/01/20/2"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:16046"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-13176"
},
{
"url": "https://bugzilla.redhat.com/2359885"
},
{
"url": "https://bugzilla.redhat.com/2359888"
},
{
"url": "https://bugzilla.redhat.com/2359892"
},
{
"url": "https://bugzilla.redhat.com/2359894"
},
{
"url": "https://bugzilla.redhat.com/2359895"
},
{
"url": "https://bugzilla.redhat.com/2359899"
},
{
"url": "https://bugzilla.redhat.com/2359900"
},
{
"url": "https://bugzilla.redhat.com/2359902"
},
{
"url": "https://bugzilla.redhat.com/2359903"
},
{
"url": "https://bugzilla.redhat.com/2359911"
},
{
"url": "https://bugzilla.redhat.com/2359918"
},
{
"url": "https://bugzilla.redhat.com/2359920"
},
{
"url": "https://bugzilla.redhat.com/2359924"
},
{
"url": "https://bugzilla.redhat.com/2359928"
},
{
"url": "https://bugzilla.redhat.com/2359930"
},
{
"url": "https://bugzilla.redhat.com/2359932"
},
{
"url": "https://bugzilla.redhat.com/2359934"
},
{
"url": "https://bugzilla.redhat.com/2359938"
},
{
"url": "https://bugzilla.redhat.com/2359940"
},
{
"url": "https://bugzilla.redhat.com/2359943"
},
{
"url": "https://bugzilla.redhat.com/2359944"
},
{
"url": "https://bugzilla.redhat.com/2359945"
},
{
"url": "https://bugzilla.redhat.com/2359947"
},
{
"url": "https://bugzilla.redhat.com/2359950"
},
{
"url": "https://bugzilla.redhat.com/2359963"
},
{
"url": "https://bugzilla.redhat.com/2359964"
},
{
"url": "https://bugzilla.redhat.com/2359972"
},
{
"url": "https://bugzilla.redhat.com/2370920"
},
{
"url": "https://bugzilla.redhat.com/2380264"
},
{
"url": "https://bugzilla.redhat.com/2380273"
},
{
"url": "https://bugzilla.redhat.com/2380274"
},
{
"url": "https://bugzilla.redhat.com/2380278"
},
{
"url": "https://bugzilla.redhat.com/2380280"
},
{
"url": "https://bugzilla.redhat.com/2380283"
},
{
"url": "https://bugzilla.redhat.com/2380284"
},
{
"url": "https://bugzilla.redhat.com/2380290"
},
{
"url": "https://bugzilla.redhat.com/2380291"
},
{
"url": "https://bugzilla.redhat.com/2380295"
},
{
"url": "https://bugzilla.redhat.com/2380298"
},
{
"url": "https://bugzilla.redhat.com/2380306"
},
{
"url": "https://bugzilla.redhat.com/2380308"
},
{
"url": "https://bugzilla.redhat.com/2380309"
},
{
"url": "https://bugzilla.redhat.com/2380310"
},
{
"url": "https://bugzilla.redhat.com/2380312"
},
{
"url": "https://bugzilla.redhat.com/2380313"
},
{
"url": "https://bugzilla.redhat.com/2380320"
},
{
"url": "https://bugzilla.redhat.com/2380321"
},
{
"url": "https://bugzilla.redhat.com/2380322"
},
{
"url": "https://bugzilla.redhat.com/2380326"
},
{
"url": "https://bugzilla.redhat.com/2380327"
},
{
"url": "https://bugzilla.redhat.com/2380334"
},
{
"url": "https://bugzilla.redhat.com/2380335"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2338999"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359885"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359888"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359892"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359894"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359895"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359899"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359900"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359902"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359903"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359911"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359918"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359920"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359924"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359928"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359930"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359932"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359934"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359938"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359940"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359943"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359944"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359945"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359947"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359950"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359963"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359964"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359972"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370920"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380264"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380273"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380274"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380278"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380280"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380283"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380284"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380290"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380291"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380295"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380298"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380306"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380308"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380309"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380310"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380312"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380313"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380320"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380321"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380322"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380326"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380327"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380334"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380335"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-13176"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21574"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21575"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21577"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21579"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21580"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21581"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21584"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21585"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21588"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30681"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30682"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30683"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30684"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30685"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30687"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30688"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30689"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30693"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30695"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30696"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30699"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30703"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30704"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30705"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30715"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30721"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30722"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50077"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50078"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50079"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50080"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50081"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50082"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50083"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50084"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50085"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50086"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50087"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50088"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50091"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50092"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50093"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50094"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50096"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50097"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50098"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50099"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50100"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50101"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50102"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50104"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5399"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2025-16046.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2025:15699"
},
{
"url": "https://github.com/advisories/GHSA-r9fv-h47r-823f"
},
{
"url": "https://github.com/openssl/openssl/commit/07272b05b04836a762b4baa874958af51d513844"
},
{
"url": "https://github.com/openssl/openssl/commit/2af62e74fb59bc469506bc37eb2990ea408d9467"
},
{
"url": "https://github.com/openssl/openssl/commit/392dcb336405a0c94486aa6655057f59fd3a0902"
},
{
"url": "https://github.com/openssl/openssl/commit/4b1cb94a734a7d4ec363ac0a215a25c181e11f65"
},
{
"url": "https://github.com/openssl/openssl/commit/77c608f4c8857e63e98e66444e2e761c9627916f"
},
{
"url": "https://github.openssl.org/openssl/extended-releases/commit/0d5fd1ab987f7571e2c955d8d8b638fc0fb54ded"
},
{
"url": "https://github.openssl.org/openssl/extended-releases/commit/a2639000db19878d5d89586ae7b725080592ae86"
},
{
"url": "https://linux.oracle.com/cve/CVE-2024-13176.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2025-16046.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00028.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13176"
},
{
"url": "https://openssl-library.org/news/secadv/20250120.txt"
},
{
"url": "https://security.netapp.com/advisory/ntap-20250124-0005"
},
{
"url": "https://security.netapp.com/advisory/ntap-20250124-0005/"
},
{
"url": "https://security.netapp.com/advisory/ntap-20250418-0010"
},
{
"url": "https://security.netapp.com/advisory/ntap-20250418-0010/"
},
{
"url": "https://security.netapp.com/advisory/ntap-20250502-0006"
},
{
"url": "https://security.netapp.com/advisory/ntap-20250502-0006/"
},
{
"url": "https://ubuntu.com/security/notices/USN-7264-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7278-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7894-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2024-13176"
},
{
"url": "https://www.oracle.com/security-alerts/cpuapr2025.html#AppendixMSQL"
}
],
"published": "2025-01-20T14:15:26+00:00",
"updated": "2026-04-15T00:35:42+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
]
},
{
"id": "CVE-2024-2236",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.9,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "rocky"
},
"severity": "medium"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
385
],
"description": "A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2024-2236"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:9404"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:3530"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:3534"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-2236"
},
{
"url": "https://bugzilla.redhat.com/2245218"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245218"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268268"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2236"
},
{
"url": "https://dev.gnupg.org/T7136"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2024-9404.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2024:9404"
},
{
"url": "https://github.com/tomato42/marvin-toolkit/tree/master/example/libgcrypt"
},
{
"url": "https://gitlab.com/redhat-crypto/libgcrypt/libgcrypt-mirror/-/merge_requests/17"
},
{
"url": "https://linux.oracle.com/cve/CVE-2024-2236.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2024-9404.html"
},
{
"url": "https://lists.gnupg.org/pipermail/gcrypt-devel/2024-March/005607.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2236"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2024-2236"
}
],
"published": "2024-03-06T22:15:57+00:00",
"updated": "2026-04-15T00:35:42+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.8.5-7.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2024-2511",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "low"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "julia"
},
"score": 5.9,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "low"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 3.7,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "rocky"
},
"severity": "low"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
1325
],
"description": "Issue summary: Some non-default TLS server configurations can cause unbounded\nmemory growth when processing TLSv1.3 sessions\n\nImpact summary: An attacker may exploit certain server configurations to trigger\nunbounded memory growth that would lead to a Denial of Service\n\nThis problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is\nbeing used (but not if early_data support is also configured and the default\nanti-replay protection is in use). In this case, under certain conditions, the\nsession cache can get into an incorrect state and it will fail to flush properly\nas it fills. The session cache will continue to grow in an unbounded manner. A\nmalicious client could deliberately create the scenario for this failure to\nforce a Denial of Service. It may also happen by accident in normal operation.\n\nThis issue only affects TLS servers supporting TLSv1.3. It does not affect TLS\nclients.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL\n1.0.2 is also not affected by this issue.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2024-2511"
},
{
"url": "http://www.openwall.com/lists/oss-security/2024/04/08/5"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:9333"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-2511"
},
{
"url": "https://bugzilla.redhat.com/2274020"
},
{
"url": "https://bugzilla.redhat.com/2281029"
},
{
"url": "https://bugzilla.redhat.com/2283757"
},
{
"url": "https://bugzilla.redhat.com/2294581"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2274020"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2281029"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2283757"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2294581"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-354112.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-613116.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-769027.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-915275.html"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2511"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4603"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4741"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5535"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2024-9333.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2024:9333"
},
{
"url": "https://github.com/advisories/GHSA-299c-jvhc-gxj8"
},
{
"url": "https://github.com/openssl/openssl/commit/7e4d731b1c07201ad9374c1cd9ac5263bdf35bce"
},
{
"url": "https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d"
},
{
"url": "https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08"
},
{
"url": "https://github.openssl.org/openssl/extended-releases/commit/5f8d25770ae6437db119dfc951e207271a326640"
},
{
"url": "https://linux.oracle.com/cve/CVE-2024-2511.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2024-9333.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2511"
},
{
"url": "https://security.netapp.com/advisory/ntap-20240503-0013"
},
{
"url": "https://security.netapp.com/advisory/ntap-20240503-0013/"
},
{
"url": "https://ubuntu.com/security/notices/USN-6937-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7894-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2024-2511"
},
{
"url": "https://www.openssl.org/news/secadv/20240408.txt"
},
{
"url": "https://www.openssl.org/news/vulnerabilities.html"
}
],
"published": "2024-04-08T14:15:07+00:00",
"updated": "2026-05-12T12:16:33+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2024-25260",
"ratings": [
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 4,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
476
],
"description": "elfutils v0.189 was discovered to contain a NULL pointer dereference via the handle_verdef() function at readelf.c.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2024-25260"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-25260"
},
{
"url": "https://github.com/schsiung/fuzzer_issues/issues/1"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25260"
},
{
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=31058"
},
{
"url": "https://sourceware.org/elfutils/"
},
{
"url": "https://ubuntu.com/security/notices/USN-7369-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2024-25260"
}
],
"published": "2024-02-20T18:15:52+00:00",
"updated": "2025-04-25T20:42:23+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "0.190-2.el8",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "0.190-2.el8",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "0.190-2.el8",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2024-33655",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "azure"
},
"severity": "high"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 3.7,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "rocky"
},
"severity": "medium"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
400
],
"description": "The DNS protocol in RFC 1035 and updates allows remote attackers to cause a denial of service (resource consumption) by arranging for DNS queries to be accumulated for seconds, such that responses are later sent in a pulsing burst (which can be considered traffic amplification in some cases), aka the \"DNSBomb\" issue.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2024-33655"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:18931"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-33655"
},
{
"url": "https://alas.aws.amazon.com/ALAS-2024-1934.html"
},
{
"url": "https://bugzilla.redhat.com/2279942"
},
{
"url": "https://bugzilla.redhat.com/2405706"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2279942"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2405706"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-33655"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11411"
},
{
"url": "https://datatracker.ietf.org/doc/html/rfc1035"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-18931.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:18931"
},
{
"url": "https://github.com/NLnetLabs/unbound/commit/c3206f4568f60c486be6d165b1f2b5b254fea3de"
},
{
"url": "https://github.com/TechnitiumSoftware/DnsServer/blob/master/CHANGELOG.md#version-120"
},
{
"url": "https://gitlab.isc.org/isc-projects/bind9/-/issues/4398"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00019.html"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3TBXPRJ2Q235YUZKYDRWOSYNDFBJQWJ3/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QITY2QBX2OCBTZIXD2A5ES62STFIA4AL/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3TBXPRJ2Q235YUZKYDRWOSYNDFBJQWJ3/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QITY2QBX2OCBTZIXD2A5ES62STFIA4AL/"
},
{
"url": "https://meterpreter.org/researchers-uncover-dnsbomb-a-new-pdos-attack-exploiting-legitimate-dns-features/"
},
{
"url": "https://nlnetlabs.nl/downloads/unbound/CVE-2024-33655.txt"
},
{
"url": "https://nlnetlabs.nl/projects/unbound/security-advisories/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33655"
},
{
"url": "https://sp2024.ieee-security.org/accepted-papers.html"
},
{
"url": "https://ubuntu.com/security/notices/USN-6791-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2024-33655"
},
{
"url": "https://www.isc.org/blogs/2024-dnsbomb/"
},
{
"url": "https://www.nlnetlabs.nl/news/2024/May/08/unbound-1.20.0-released/"
}
],
"published": "2024-06-06T17:15:51+00:00",
"updated": "2026-04-15T00:35:42+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.16.2-5.10.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.16.2-5.10.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2024-34459",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "low"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "high"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "low"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 5.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
122
],
"description": "An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error messages with xmllint --htmlout can result in a buffer over-read in xmlHTMLPrintFileContext in xmllint.c.",
"recommendation": "Upgrade libxml2 to version 2.9.7-21.el8_10.5",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2024-34459"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:26354"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-34459"
},
{
"url": "https://bugzilla.redhat.com/2280532"
},
{
"url": "https://errata.almalinux.org/8/ALSA-2026-26354.html"
},
{
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/720"
},
{
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.11.8"
},
{
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.12.7"
},
{
"url": "https://linux.oracle.com/cve/CVE-2024-34459.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2026-26354.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00014.html"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5HVUXKYTBWT3G5DEEQX62STJQBY367NL/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/INKSSLW5VMZIXHRPZBAW4TJUX5SQKARG/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VRDJCNQP32LV56KESUQ5SNZKAJWSZZRI/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5HVUXKYTBWT3G5DEEQX62STJQBY367NL/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/INKSSLW5VMZIXHRPZBAW4TJUX5SQKARG/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VRDJCNQP32LV56KESUQ5SNZKAJWSZZRI/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34459"
},
{
"url": "https://ubuntu.com/security/notices/USN-7240-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7302-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34459"
}
],
"published": "2024-05-14T15:39:11+00:00",
"updated": "2025-11-04T22:16:01+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.9.7-21.el8_10.4",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
}
},
{
"id": "CVE-2024-41996",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.9,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"cwes": [
295
],
"description": "Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2024-41996"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-41996"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-089022.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-485750.html"
},
{
"url": "https://dheatattack.gitlab.io/details/"
},
{
"url": "https://dheatattack.gitlab.io/faq/"
},
{
"url": "https://gist.github.com/c0r0n3r/abccc14d4d96c0442f3a77fa5ca255d1"
},
{
"url": "https://github.com/openssl/openssl/issues/17374"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41996"
},
{
"url": "https://openssl-library.org/post/2022-10-21-tls-groups-configuration/"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41996"
}
],
"published": "2024-08-26T06:15:04+00:00",
"updated": "2026-05-12T12:17:03+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2024-43167",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "low"
},
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "low"
},
{
"source": {
"name": "photon"
},
"severity": "low"
},
{
"source": {
"name": "redhat"
},
"score": 2.8,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
476
],
"description": "DISPUTE NOTE: this issue does not pose a security risk as it (according to analysis by the original software developer, NLnet Labs) falls within the expected functionality and security controls of the application. Red Hat has made a claim that there is a security risk within Red Hat products. NLnet Labs has no further information about the claim, and suggests that affected Red Hat customers refer to available Red Hat documentation or support channels. ORIGINAL DESCRIPTION: A NULL pointer dereference flaw was found in the ub_ctx_set_fwd function in Unbound. This issue could allow an attacker who can invoke specific sequences of API calls to cause a segmentation fault. When certain API functions such as ub_ctx_set_fwd and ub_ctx_resolvconf are called in a particular order, the program attempts to read from a NULL pointer, leading to a crash. This issue can result in a denial of service by causing the application to terminate unexpectedly.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2024-43167"
},
{
"url": "http://www.openwall.com/lists/oss-security/2024/08/16/6"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-43167"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2303456"
},
{
"url": "https://github.com/NLnetLabs/unbound/issues/1072"
},
{
"url": "https://github.com/NLnetLabs/unbound/pull/1073"
},
{
"url": "https://github.com/NLnetLabs/unbound/pull/1073/files"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00046.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43167"
},
{
"url": "https://ubuntu.com/security/notices/USN-6998-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2024-43167"
}
],
"published": "2024-08-12T13:38:35+00:00",
"updated": "2026-04-15T00:35:42+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.16.2-5.10.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.16.2-5.10.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2024-43168",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "low"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 4.8,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
122
],
"description": "DISPUTE NOTE: this issue does not pose a security risk as it (according to analysis by the original software developer, NLnet Labs) falls within the expected functionality and security controls of the application. Red Hat has made a claim that there is a security risk within Red Hat products. NLnet Labs has no further information about the claim, and suggests that affected Red Hat customers refer to available Red Hat documentation or support channels. ORIGINAL DESCRIPTION: A heap-buffer-overflow flaw was found in the cfg_mark_ports function within Unbound's config_file.c, which can lead to memory corruption. This issue could allow an attacker with local access to provide specially crafted input, potentially causing the application to crash or allowing arbitrary code execution. This could result in a denial of service or unauthorized actions on the system.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2024-43168"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-43168"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2303462"
},
{
"url": "https://github.com/NLnetLabs/unbound/issues/1039"
},
{
"url": "https://github.com/NLnetLabs/unbound/pull/1040"
},
{
"url": "https://github.com/NLnetLabs/unbound/pull/1040/files"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00046.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43168"
},
{
"url": "https://ubuntu.com/security/notices/USN-6998-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2024-43168"
}
],
"published": "2024-08-12T13:38:36+00:00",
"updated": "2026-04-15T00:35:42+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.16.2-5.10.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.16.2-5.10.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2024-4741",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "low"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "high"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "high"
},
{
"source": {
"name": "julia"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 5.6,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"source": {
"name": "rocky"
},
"severity": "low"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
416
],
"description": "Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause\nmemory to be accessed that was previously freed in some situations\n\nImpact summary: A use after free can have a range of potential consequences such\nas the corruption of valid data, crashes or execution of arbitrary code.\nHowever, only applications that directly call the SSL_free_buffers function are\naffected by this issue. Applications that do not call this function are not\nvulnerable. Our investigations indicate that this function is rarely used by\napplications.\n\nThe SSL_free_buffers function is used to free the internal OpenSSL buffer used\nwhen processing an incoming record from the network. The call is only expected\nto succeed if the buffer is not currently in use. However, two scenarios have\nbeen identified where the buffer is freed even when still in use.\n\nThe first scenario occurs where a record header has been received from the\nnetwork and processed by OpenSSL, but the full record body has not yet arrived.\nIn this case calling SSL_free_buffers will succeed even though a record has only\nbeen partially processed and the buffer is still in use.\n\nThe second scenario occurs where a full record containing application data has\nbeen received and processed by OpenSSL but the application has only read part of\nthis data. Again a call to SSL_free_buffers will succeed even though the buffer\nis still in use.\n\nWhile these scenarios could occur accidentally during normal operation a\nmalicious attacker could attempt to engineer a stituation where this occurs.\nWe are not aware of this issue being actively exploited.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.",
"recommendation": "Upgrade openssl to version 1:1.1.1k-16.el8_6; Upgrade openssl-libs to version 1:1.1.1k-16.el8_6",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2024-4741"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:9333"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-4741"
},
{
"url": "https://bugzilla.redhat.com/2274020"
},
{
"url": "https://bugzilla.redhat.com/2281029"
},
{
"url": "https://bugzilla.redhat.com/2283757"
},
{
"url": "https://bugzilla.redhat.com/2294581"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2274020"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2281029"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2283757"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2294581"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2511"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4603"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4741"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5535"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2024-9333.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2024:9333"
},
{
"url": "https://github.com/advisories/GHSA-6vgq-8qjq-h578"
},
{
"url": "https://github.com/openssl/openssl/commit/704f725b96aa373ee45ecfb23f6abfe8be8d9177"
},
{
"url": "https://github.com/openssl/openssl/commit/b3f0eb0a295f58f16ba43ba99dad70d4ee5c437d"
},
{
"url": "https://github.com/openssl/openssl/commit/c88c3de51020c37e8706bf7a682a162593053aac"
},
{
"url": "https://github.com/openssl/openssl/commit/e5093133c35ca82874ad83697af76f4b0f7e3bd8"
},
{
"url": "https://github.openssl.org/openssl/extended-releases/commit/f7a045f3143fc6da2ee66bf52d8df04829590dd4"
},
{
"url": "https://linux.oracle.com/cve/CVE-2024-4741.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2026-26275.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4741"
},
{
"url": "https://security.netapp.com/advisory/ntap-20240621-0004"
},
{
"url": "https://security.netapp.com/advisory/ntap-20240621-0004/"
},
{
"url": "https://ubuntu.com/security/notices/USN-6937-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7894-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2024-4741"
},
{
"url": "https://www.openssl.org/news/secadv/20240528.txt"
}
],
"published": "2024-11-13T11:15:04+00:00",
"updated": "2026-04-15T00:35:42+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
}
},
{
"id": "CVE-2024-56433",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "low"
},
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "low"
},
{
"source": {
"name": "redhat"
},
"score": 3.6,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
},
{
"source": {
"name": "rocky"
},
"severity": "low"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
1188
],
"description": "shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2024-56433"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:20559"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-56433"
},
{
"url": "https://bugzilla.redhat.com/2334165"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2334165"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56433"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2025-20559.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2025:20559"
},
{
"url": "https://github.com/shadow-maint/shadow/blob/e2512d5741d4a44bdd81a8c2d0029b6222728cf0/etc/login.defs#L238-L241"
},
{
"url": "https://github.com/shadow-maint/shadow/issues/1157"
},
{
"url": "https://github.com/shadow-maint/shadow/releases/tag/4.4"
},
{
"url": "https://linux.oracle.com/cve/CVE-2024-56433.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2025-20559-0.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56433"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2024-56433"
}
],
"published": "2024-12-26T09:15:07+00:00",
"updated": "2026-04-15T00:35:42+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2",
"versions": [
{
"version": "2:4.6-23.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2024-57970",
"ratings": [
{
"source": {
"name": "julia"
},
"score": 4,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 4,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "rocky"
},
"severity": "medium"
}
],
"cwes": [
126
],
"description": "libarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in archive_read_support_format_tar.c via a TAR archive because it mishandles truncation in the middle of a GNU long linkname.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2024-57970"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-57970"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2345954"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57970"
},
{
"url": "https://errata.rockylinux.org/RLSA-2025:7510"
},
{
"url": "https://github.com/advisories/GHSA-2q66-6w43-8rm9"
},
{
"url": "https://github.com/libarchive/libarchive/issues/2415"
},
{
"url": "https://github.com/libarchive/libarchive/pull/2422"
},
{
"url": "https://linux.oracle.com/cve/CVE-2024-57970.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2025-7510.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57970"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2024-57970"
}
],
"published": "2025-02-16T04:15:21+00:00",
"updated": "2026-04-15T00:35:42+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.3.3-7.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2024-7264",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.3,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
125
],
"description": "libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an\nASN.1 Generalized Time field. If given an syntactically incorrect field, the\nparser might end up using -1 for the length of the *time fraction*, leading to\na `strlen()` getting performed on a pointer to a heap buffer area that is not\n(purposely) null terminated.\n\nThis flaw most likely leads to a crash, but can also lead to heap contents\ngetting returned to the application when\n[CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2024-7264"
},
{
"url": "http://www.openwall.com/lists/oss-security/2024/07/31/1"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:1671"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-7264"
},
{
"url": "https://bugzilla.redhat.com/2294581"
},
{
"url": "https://bugzilla.redhat.com/2294676"
},
{
"url": "https://bugzilla.redhat.com/2301888"
},
{
"url": "https://bugzilla.redhat.com/2318857"
},
{
"url": "https://bugzilla.redhat.com/2318858"
},
{
"url": "https://bugzilla.redhat.com/2318870"
},
{
"url": "https://bugzilla.redhat.com/2318873"
},
{
"url": "https://bugzilla.redhat.com/2318874"
},
{
"url": "https://bugzilla.redhat.com/2318876"
},
{
"url": "https://bugzilla.redhat.com/2318882"
},
{
"url": "https://bugzilla.redhat.com/2318883"
},
{
"url": "https://bugzilla.redhat.com/2318884"
},
{
"url": "https://bugzilla.redhat.com/2318885"
},
{
"url": "https://bugzilla.redhat.com/2318886"
},
{
"url": "https://bugzilla.redhat.com/2318897"
},
{
"url": "https://bugzilla.redhat.com/2318900"
},
{
"url": "https://bugzilla.redhat.com/2318905"
},
{
"url": "https://bugzilla.redhat.com/2318914"
},
{
"url": "https://bugzilla.redhat.com/2318922"
},
{
"url": "https://bugzilla.redhat.com/2318923"
},
{
"url": "https://bugzilla.redhat.com/2318925"
},
{
"url": "https://bugzilla.redhat.com/2318926"
},
{
"url": "https://bugzilla.redhat.com/2318927"
},
{
"url": "https://bugzilla.redhat.com/2331191"
},
{
"url": "https://bugzilla.redhat.com/2339218"
},
{
"url": "https://bugzilla.redhat.com/2339220"
},
{
"url": "https://bugzilla.redhat.com/2339221"
},
{
"url": "https://bugzilla.redhat.com/2339226"
},
{
"url": "https://bugzilla.redhat.com/2339231"
},
{
"url": "https://bugzilla.redhat.com/2339236"
},
{
"url": "https://bugzilla.redhat.com/2339238"
},
{
"url": "https://bugzilla.redhat.com/2339243"
},
{
"url": "https://bugzilla.redhat.com/2339247"
},
{
"url": "https://bugzilla.redhat.com/2339252"
},
{
"url": "https://bugzilla.redhat.com/2339259"
},
{
"url": "https://bugzilla.redhat.com/2339266"
},
{
"url": "https://bugzilla.redhat.com/2339270"
},
{
"url": "https://bugzilla.redhat.com/2339271"
},
{
"url": "https://bugzilla.redhat.com/2339275"
},
{
"url": "https://bugzilla.redhat.com/2339277"
},
{
"url": "https://bugzilla.redhat.com/2339281"
},
{
"url": "https://bugzilla.redhat.com/2339284"
},
{
"url": "https://bugzilla.redhat.com/2339291"
},
{
"url": "https://bugzilla.redhat.com/2339293"
},
{
"url": "https://bugzilla.redhat.com/2339295"
},
{
"url": "https://bugzilla.redhat.com/2339299"
},
{
"url": "https://bugzilla.redhat.com/2339300"
},
{
"url": "https://bugzilla.redhat.com/2339304"
},
{
"url": "https://bugzilla.redhat.com/2339305"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2294581"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2294676"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2301888"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318857"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318858"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318870"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318873"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318874"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318876"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318882"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318883"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318884"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318885"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318886"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318897"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318900"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318905"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318914"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318922"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318923"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318925"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318926"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318927"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331191"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339218"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339220"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339221"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339226"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339231"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339236"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339238"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339243"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339247"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339252"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339259"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339266"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339270"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339271"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339275"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339277"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339281"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339284"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339291"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339293"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339295"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339299"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339300"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339304"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339305"
},
{
"url": "https://curl.se/docs/CVE-2024-7264.html"
},
{
"url": "https://curl.se/docs/CVE-2024-7264.json"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-11053"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21193"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21194"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21196"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21197"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21198"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21199"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21201"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21203"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21212"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21213"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21218"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21219"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21230"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21231"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21236"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21237"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21238"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21239"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21241"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21247"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37371"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5535"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7264"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21490"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21491"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21494"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21497"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21500"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21501"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21503"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21504"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21505"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21518"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21519"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21520"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21521"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21522"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21523"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21525"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21529"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21531"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21534"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21536"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21540"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21543"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21546"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21555"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21559"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2025-1671.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2025:1671"
},
{
"url": "https://github.com/curl/curl/commit/27959ecce75cdb2809c0bdb3286e60e08fadb519"
},
{
"url": "https://hackerone.com/reports/2629968"
},
{
"url": "https://linux.oracle.com/cve/CVE-2024-7264.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2025-1673.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7264"
},
{
"url": "https://security.netapp.com/advisory/ntap-20240828-0008/"
},
{
"url": "https://security.netapp.com/advisory/ntap-20241025-0006/"
},
{
"url": "https://security.netapp.com/advisory/ntap-20241025-0010/"
},
{
"url": "https://ubuntu.com/security/notices/USN-6944-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-6944-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2024-7264"
},
{
"url": "https://www.oracle.com/security-alerts/cpuoct2024.html#AppendixMSQL"
}
],
"published": "2024-07-31T08:15:02+00:00",
"updated": "2025-11-03T23:17:31+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.11",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.11",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2024-7592",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "low"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "high"
},
{
"source": {
"name": "bitnami"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "high"
},
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "low"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 4.8,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "rocky"
},
"severity": "low"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
400,
1333
],
"description": "There is a LOW severity vulnerability affecting CPython, specifically the\n'http.cookies' standard library module.\n\n\nWhen parsing cookies that contained backslashes for quoted characters in\nthe cookie value, the parser would use an algorithm with quadratic\ncomplexity, resulting in excess CPU resources being used while parsing the\nvalue.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2024-7592"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:3634"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-7592"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2305879"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7592"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2025-3634.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2025:3634"
},
{
"url": "https://github.com/python/cpython/commit/391e5626e3ee5af267b97e37abc7475732e67621"
},
{
"url": "https://github.com/python/cpython/commit/44e458357fca05ca0ae2658d62c8c595b048b5ef"
},
{
"url": "https://github.com/python/cpython/commit/a77ab24427a18bff817025adb03ca920dc3f1a06"
},
{
"url": "https://github.com/python/cpython/commit/b2f11ca7667e4d57c71c1c88b255115f16042d9a"
},
{
"url": "https://github.com/python/cpython/commit/d4ac921a4b081f7f996a5d2b101684b67ba0ed7f"
},
{
"url": "https://github.com/python/cpython/commit/d662e2db2605515a767f88ad48096b8ac623c774"
},
{
"url": "https://github.com/python/cpython/commit/dcc3eaef98cd94d6cb6cb0f44bd1c903d04f33b1"
},
{
"url": "https://github.com/python/cpython/issues/123067"
},
{
"url": "https://github.com/python/cpython/pull/123075"
},
{
"url": "https://linux.oracle.com/cve/CVE-2024-7592.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2025-3634.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"
},
{
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/HXJAAAALNUNGCQUS2W7WR6GFIZIHFOOK/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7592"
},
{
"url": "https://security.netapp.com/advisory/ntap-20241018-0006/"
},
{
"url": "https://ubuntu.com/security/notices/USN-7015-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7015-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2024-7592"
}
],
"published": "2024-08-19T19:15:08+00:00",
"updated": "2025-11-03T23:17:31+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-76.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-76.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": "Temurin JVM binary is not linked against freetype library:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\nlinux-vdso.so.1 (0x0000ffff8cd00000)\nlibjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\nlibpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\nlibdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\nlibc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n/lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
}
},
{
"id": "CVE-2025-11411",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 6.1,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N"
},
{
"source": {
"name": "rocky"
},
"severity": "medium"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
349
],
"description": "NLnet Labs Unbound up to and including version 1.24.1 is vulnerable to possible domain hijack attacks. Promiscuous NS RRSets that complement positive DNS replies in the authority section can be used to trick resolvers to update their delegation information for the zone. Usually these RRSets are used to update the resolver's knowledge of the zone's name servers. A malicious actor can exploit the possible poisonous effect by injecting NS RRSets (and possibly their respective address records) in a reply. This could be done for example by trying to spoof a packet or fragmentation attacks. Unbound would then proceed to update the NS RRSet data it already has since the new data has enough trust for it, i.e., in-zone data for the delegation point. Unbound 1.24.1 includes a fix that scrubs unsolicited NS RRSets (and their respective address records) from replies mitigating the possible poison effect. Unbound 1.24.2 includes an additional fix that scrubs unsolicited NS RRSets (and their respective address records) from YXDOMAIN and non-referral nodata replies, further mitigating the possible poison effect.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-11411"
},
{
"url": "http://www.openwall.com/lists/oss-security/2025/11/26/4"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:18931"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-11411"
},
{
"url": "https://bugzilla.redhat.com/2279942"
},
{
"url": "https://bugzilla.redhat.com/2405706"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2279942"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2405706"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-33655"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11411"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-18931.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:18931"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/11/msg00008.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/11/msg00032.html"
},
{
"url": "https://nlnetlabs.nl/news/2025/Nov/26/unbound-1.24.2-released/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11411"
},
{
"url": "https://ubuntu.com/security/notices/USN-7855-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7855-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-11411"
},
{
"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2025-11411.txt"
}
],
"published": "2025-10-22T13:15:29+00:00",
"updated": "2026-04-15T00:35:42+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.16.2-5.10.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.16.2-5.10.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-11468",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 4.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
93
],
"description": "When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-11468"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-11468"
},
{
"url": "https://github.com/python/cpython/commit/003b8315669b9f08b1010a49071f73f15f818094"
},
{
"url": "https://github.com/python/cpython/commit/17d1490aa97bd6b98a42b1a9b324ead84e7fd8a2"
},
{
"url": "https://github.com/python/cpython/commit/61614a5e5056e4f61ced65008d4576f3df34acb6"
},
{
"url": "https://github.com/python/cpython/commit/a76e4cd62dd68e7cbe86e37e6ed988495a646b66"
},
{
"url": "https://github.com/python/cpython/commit/e9970f077240c7c670e8a6fc6662f2b30d3b6ad0"
},
{
"url": "https://github.com/python/cpython/commit/f738386838021c762efea6c9802c82de65e87796"
},
{
"url": "https://github.com/python/cpython/issues/143935"
},
{
"url": "https://github.com/python/cpython/pull/143936"
},
{
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/FELSEOLBI2QR6YLG6Q7VYF7FWSGQTKLI/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11468"
},
{
"url": "https://ubuntu.com/security/notices/USN-8018-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-11468"
}
],
"published": "2026-01-20T22:15:50+00:00",
"updated": "2026-04-15T00:35:42+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-76.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-76.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-11961",
"ratings": [
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "low"
},
{
"source": {
"name": "redhat"
},
"score": 1.9,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N"
}
],
"cwes": [
122,
126
],
"description": "pcap_ether_aton() is an auxiliary function in libpcap, it takes a string argument and returns a fixed-size allocated buffer. The string argument must be a well-formed MAC-48 address in one of the supported formats, but this requirement has been poorly documented. If an application calls the function with an argument that deviates from the expected format, the function can read data beyond the end of the provided string and write data beyond the end of the allocated buffer.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-11961"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-11961"
},
{
"url": "https://github.com/the-tcpdump-group/libpcap/commit/b2d2f9a9a0581c40780bde509f7cc715920f1c02"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11961"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-11961"
}
],
"published": "2025-12-31T01:15:54+00:00",
"updated": "2026-04-15T00:35:42+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14",
"versions": [
{
"version": "14:1.9.1-5.el8",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-12781",
"ratings": [
{
"source": {
"name": "nvd"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
{
"source": {
"name": "redhat"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
}
],
"cwes": [
704
],
"description": "When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the \"base64\" module the characters \"+/\" will always be accepted, regardless of the value of \"altchars\" parameter, typically used to establish an \"alternative base64 alphabet\" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.\n\n\n\n\nThis behavior can only be insecure if your application uses an alternate base64 alphabet (without \"+/\"). If your application does not use the \"altchars\" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.\n\n\n\n\nThe attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python.\u00a0Users are recommended to mitigate by verifying user-controlled inputs match the base64 \nalphabet they are expecting or verify that their application would not be \naffected if the b64decode() functions accepted \"+\" or \"/\" outside of altchars.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-12781"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-12781"
},
{
"url": "https://github.com/python/cpython/commit/13360efd385d1a7d0659beba03787ea3d063ef9b"
},
{
"url": "https://github.com/python/cpython/commit/1be80bec7960f5ccd059e75f3dfbd45fca302947"
},
{
"url": "https://github.com/python/cpython/commit/9060b4abbe475591b6230b23c2afefeff26fcca5"
},
{
"url": "https://github.com/python/cpython/commit/e95e783dff443b68e8179fdb57737025bf02ba76"
},
{
"url": "https://github.com/python/cpython/commit/fd17ee026fa9b67f6288cbafe374a3e479fe03a5"
},
{
"url": "https://github.com/python/cpython/issues/125346"
},
{
"url": "https://github.com/python/cpython/pull/141128"
},
{
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/KRI7GC6S27YV5NJ4FPDALS2WI5ENAFJ6/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12781"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-12781"
}
],
"published": "2026-01-21T20:16:04+00:00",
"updated": "2026-02-02T17:25:23+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-76.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-76.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-13034",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "julia"
},
"score": 5.9,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 6.8,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
295
],
"description": "When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey`\nwith the curl tool,curl should check the public key of the server certificate\nto verify the peer.\n\nThis check was skipped in a certain condition that would then make curl allow\nthe connection without performing the proper check, thus not noticing a\npossible impostor. To skip this check, the connection had to be done with QUIC\nwith ngtcp2 built to use GnuTLS and the user had to explicitly disable the\nstandard certificate verification.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-13034"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-13034"
},
{
"url": "https://curl.se/docs/CVE-2025-13034.html"
},
{
"url": "https://curl.se/docs/CVE-2025-13034.json"
},
{
"url": "https://github.com/advisories/GHSA-9r76-qj98-jfhc"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13034"
},
{
"url": "https://ubuntu.com/security/notices/USN-8062-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13034"
}
],
"published": "2026-01-08T10:15:45+00:00",
"updated": "2026-01-20T14:54:02+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.11",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.11",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-13151",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "low"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 5.9,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
787
],
"description": "Stack-based buffer overflow in libtasn1 version: v4.20.0. The function fails to validate the size of input data resulting in a buffer overflow in asn1_expend_octet_string.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-13151"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/01/08/5"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-13151"
},
{
"url": "https://gitlab.com/gnutls/libtasn1"
},
{
"url": "https://gitlab.com/gnutls/libtasn1/-/merge_requests/121"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13151"
},
{
"url": "https://ubuntu.com/security/notices/USN-7954-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7954-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13151"
},
{
"url": "https://www.kb.cert.org/vuls/id/271649"
}
],
"published": "2026-01-07T22:15:43+00:00",
"updated": "2026-02-02T19:27:23+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "4.13-5.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-13837",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "nvd"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.9,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
400
],
"description": "When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-13837"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:19177"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-13837"
},
{
"url": "https://bugzilla.redhat.com/2395108"
},
{
"url": "https://bugzilla.redhat.com/2408891"
},
{
"url": "https://bugzilla.redhat.com/2418084"
},
{
"url": "https://bugzilla.redhat.com/2431366"
},
{
"url": "https://bugzilla.redhat.com/2431374"
},
{
"url": "https://bugzilla.redhat.com/2444691"
},
{
"url": "https://bugzilla.redhat.com/2448168"
},
{
"url": "https://bugzilla.redhat.com/2448181"
},
{
"url": "https://bugzilla.redhat.com/2449649"
},
{
"url": "https://bugzilla.redhat.com/2457409"
},
{
"url": "https://bugzilla.redhat.com/2457932"
},
{
"url": "https://bugzilla.redhat.com/2458049"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2395108"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2408891"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418084"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431366"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431374"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444691"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448168"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448181"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449649"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457409"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457932"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458049"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13837"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15282"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59375"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6075"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0672"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1502"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2297"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3644"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4224"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4519"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4786"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6100"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-19177.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:19177"
},
{
"url": "https://github.com/python/cpython/commit/568342cfc8f002d9a15f30238f26b9d2e0e79036"
},
{
"url": "https://github.com/python/cpython/commit/5a8b19677d818fb41ee55f310233772e15aa1a2b"
},
{
"url": "https://github.com/python/cpython/commit/694922cf40aa3a28f898b5f5ee08b71b4922df70"
},
{
"url": "https://github.com/python/cpython/commit/71fa8eb8233b37f16c88b6e3e583b461b205d1ba"
},
{
"url": "https://github.com/python/cpython/commit/b64441e4852383645af5b435411a6f849dd1b4cb"
},
{
"url": "https://github.com/python/cpython/commit/cefee7d118a26ef6cd43db59bb9d98ca9a331111"
},
{
"url": "https://github.com/python/cpython/issues/119342"
},
{
"url": "https://github.com/python/cpython/pull/119343"
},
{
"url": "https://linux.oracle.com/cve/CVE-2025-13837.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2026-10950.html"
},
{
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/2X5IBCJXRQAZ5PSERLHMSJFBHFR3QM2C/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13837"
},
{
"url": "https://ubuntu.com/security/notices/USN-8018-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13837"
}
],
"published": "2025-12-01T18:16:04+00:00",
"updated": "2026-03-03T15:16:14+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-76.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-76.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-14017",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "julia"
},
"score": 6.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 4.8,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"description": "When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl,\nchanging TLS options in one thread would inadvertently change them globally\nand therefore possibly also affect other concurrently setup transfers.\n\nDisabling certificate verification for a specific transfer could\nunintentionally disable the feature for other threads as well.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-14017"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/01/07/3"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-14017"
},
{
"url": "https://curl.se/docs/CVE-2025-14017.html"
},
{
"url": "https://curl.se/docs/CVE-2025-14017.json"
},
{
"url": "https://github.com/advisories/GHSA-jh4h-2cg6-889h"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14017"
},
{
"url": "https://ubuntu.com/security/notices/USN-8062-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8062-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14017"
}
],
"published": "2026-01-08T10:15:45+00:00",
"updated": "2026-01-27T21:29:39+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.11",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.11",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-14524",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "julia"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 6.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
601
],
"description": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,\nPOP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new\ntarget host.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-14524"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/01/07/4"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-14524"
},
{
"url": "https://curl.se/docs/CVE-2025-14524.html"
},
{
"url": "https://curl.se/docs/CVE-2025-14524.json"
},
{
"url": "https://github.com/advisories/GHSA-g897-jvjx-78vg"
},
{
"url": "https://hackerone.com/reports/3459417"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14524"
},
{
"url": "https://ubuntu.com/security/notices/USN-8062-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14524"
}
],
"published": "2026-01-08T10:15:46+00:00",
"updated": "2026-01-20T14:53:11+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.11",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.11",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-15079",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "julia"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 8.1,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
297
],
"description": "When doing SSH-based transfers using either SCP or SFTP, and setting the\nknown_hosts file, libcurl could still mistakenly accept connecting to hosts\n*not present* in the specified file if they were added as recognized in the\nlibssh *global* known_hosts file.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-15079"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/01/07/6"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-15079"
},
{
"url": "https://curl.se/docs/CVE-2025-15079.html"
},
{
"url": "https://curl.se/docs/CVE-2025-15079.json"
},
{
"url": "https://github.com/advisories/GHSA-7q9p-cx8r-rh2q"
},
{
"url": "https://hackerone.com/reports/3477116"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15079"
},
{
"url": "https://ubuntu.com/security/notices/USN-8062-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8062-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15079"
}
],
"published": "2026-01-08T10:15:47+00:00",
"updated": "2026-01-20T14:50:24+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.11",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.11",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "in_triage",
"justification": "",
"response": [],
"detail": "This CVE is under investigation by Confluent."
}
},
{
"id": "CVE-2025-15224",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "julia"
},
"score": 3.1,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"
},
{
"source": {
"name": "photon"
},
"severity": "low"
},
{
"source": {
"name": "redhat"
},
"score": 4.7,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
287
],
"description": "When doing SSH-based transfers using either SCP or SFTP, and asked to do\npublic key authentication, curl would wrongly still ask and authenticate using\na locally running SSH agent.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-15224"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/01/07/7"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-15224"
},
{
"url": "https://curl.se/docs/CVE-2025-15224.html"
},
{
"url": "https://curl.se/docs/CVE-2025-15224.json"
},
{
"url": "https://github.com/advisories/GHSA-hccr-q52r-4w88"
},
{
"url": "https://hackerone.com/reports/3480925"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15224"
},
{
"url": "https://ubuntu.com/security/notices/USN-8062-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8062-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15224"
}
],
"published": "2026-01-08T10:15:47+00:00",
"updated": "2026-01-20T14:47:52+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.11",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.11",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-15282",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 4.8,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
93
],
"description": "User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-15282"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:19177"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-15282"
},
{
"url": "https://bugzilla.redhat.com/2395108"
},
{
"url": "https://bugzilla.redhat.com/2408891"
},
{
"url": "https://bugzilla.redhat.com/2418084"
},
{
"url": "https://bugzilla.redhat.com/2431366"
},
{
"url": "https://bugzilla.redhat.com/2431374"
},
{
"url": "https://bugzilla.redhat.com/2444691"
},
{
"url": "https://bugzilla.redhat.com/2448168"
},
{
"url": "https://bugzilla.redhat.com/2448181"
},
{
"url": "https://bugzilla.redhat.com/2449649"
},
{
"url": "https://bugzilla.redhat.com/2457409"
},
{
"url": "https://bugzilla.redhat.com/2457932"
},
{
"url": "https://bugzilla.redhat.com/2458049"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2395108"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2408891"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418084"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431366"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431374"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444691"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448168"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448181"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449649"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457409"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457932"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458049"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13837"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15282"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59375"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6075"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0672"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1502"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2297"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3644"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4224"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4519"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4786"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6100"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-19177.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:19177"
},
{
"url": "https://github.com/python/cpython/commit/05356b1cc153108aaf27f3b72ce438af4aa218c0"
},
{
"url": "https://github.com/python/cpython/commit/34d76b00dabde81a793bd06dd8ecb057838c4b38"
},
{
"url": "https://github.com/python/cpython/commit/3f396ca9d7bbe2a50ea6b8c9b27c0082884d9f80"
},
{
"url": "https://github.com/python/cpython/commit/4ed11d3cd288e6b90196a15c5a825a45d318fe47"
},
{
"url": "https://github.com/python/cpython/commit/a35ca3be5842505dab74dc0b90b89cde0405017a"
},
{
"url": "https://github.com/python/cpython/commit/f25509e78e8be6ea73c811ac2b8c928c28841b9f"
},
{
"url": "https://github.com/python/cpython/issues/143925"
},
{
"url": "https://github.com/python/cpython/pull/143926"
},
{
"url": "https://linux.oracle.com/cve/CVE-2025-15282.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2026-10950.html"
},
{
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/X66HL7SISGJT33J53OHXMZT4DFLMHVKF/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15282"
},
{
"url": "https://ubuntu.com/security/notices/USN-8018-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8018-3"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15282"
}
],
"published": "2026-01-20T22:15:50+00:00",
"updated": "2026-04-15T00:35:42+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-76.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-76.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-15468",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "julia"
},
"score": 5.9,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.9,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
476
],
"description": "Issue summary: If an application using the SSL_CIPHER_find() function in\na QUIC protocol client or server receives an unknown cipher suite from\nthe peer, a NULL dereference occurs.\n\nImpact summary: A NULL pointer dereference leads to abnormal termination of\nthe running process causing Denial of Service.\n\nSome applications call SSL_CIPHER_find() from the client_hello_cb callback\non the cipher ID received from the peer. If this is done with an SSL object\nimplementing the QUIC protocol, NULL pointer dereference will happen if\nthe examined cipher ID is unknown or unsupported.\n\nAs it is not very common to call this function in applications using the QUIC \nprotocol and the worst outcome is Denial of Service, the issue was assessed\nas Low severity.\n\nThe vulnerable code was introduced in the 3.2 version with the addition\nof the QUIC protocol support.\n\nThe FIPS modules in 3.6, 3.5, 3.4 and 3.3 are not affected by this issue,\nas the QUIC implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4 and 3.3 are vulnerable to this issue.\n\nOpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-15468"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:1473"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-15468"
},
{
"url": "https://bugzilla.redhat.com/2430375"
},
{
"url": "https://bugzilla.redhat.com/2430376"
},
{
"url": "https://bugzilla.redhat.com/2430377"
},
{
"url": "https://bugzilla.redhat.com/2430378"
},
{
"url": "https://bugzilla.redhat.com/2430379"
},
{
"url": "https://bugzilla.redhat.com/2430380"
},
{
"url": "https://bugzilla.redhat.com/2430381"
},
{
"url": "https://bugzilla.redhat.com/2430386"
},
{
"url": "https://bugzilla.redhat.com/2430387"
},
{
"url": "https://bugzilla.redhat.com/2430388"
},
{
"url": "https://bugzilla.redhat.com/2430389"
},
{
"url": "https://bugzilla.redhat.com/2430390"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430375"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430376"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430377"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430378"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430379"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430380"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430381"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430386"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430387"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430388"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430389"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430390"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11187"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15467"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15468"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15469"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66199"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68160"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69418"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69419"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69420"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69421"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22795"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22796"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-1473.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:1473"
},
{
"url": "https://github.com/advisories/GHSA-rhx3-fg8p-f9m4"
},
{
"url": "https://github.com/openssl/openssl/commit/1f08e54bad32843044fe8a675948d65e3b4ece65"
},
{
"url": "https://github.com/openssl/openssl/commit/7c88376731c589ee5b36116c5a6e32d5ae5f7ae2"
},
{
"url": "https://github.com/openssl/openssl/commit/b2539639400288a4580fe2d76247541b976bade4"
},
{
"url": "https://github.com/openssl/openssl/commit/d75b309879631d45b972396ce4e5102559c64ac7"
},
{
"url": "https://linux.oracle.com/cve/CVE-2025-15468.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2026-50081.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15468"
},
{
"url": "https://openssl-library.org/news/secadv/20260127.txt"
},
{
"url": "https://ubuntu.com/security/notices/USN-7980-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15468"
}
],
"published": "2026-01-27T16:16:14+00:00",
"updated": "2026-02-02T18:38:00+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
}
},
{
"id": "CVE-2025-15469",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "julia"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
347
],
"description": "Issue summary: The 'openssl dgst' command-line tool silently truncates input\ndata to 16MB when using one-shot signing algorithms and reports success instead\nof an error.\n\nImpact summary: A user signing or verifying files larger than 16MB with\none-shot algorithms (such as Ed25519, Ed448, or ML-DSA) may believe the entire\nfile is authenticated while trailing data beyond 16MB remains unauthenticated.\n\nWhen the 'openssl dgst' command is used with algorithms that only support\none-shot signing (Ed25519, Ed448, ML-DSA-44, ML-DSA-65, ML-DSA-87), the input\nis buffered with a 16MB limit. If the input exceeds this limit, the tool\nsilently truncates to the first 16MB and continues without signaling an error,\ncontrary to what the documentation states. This creates an integrity gap where\ntrailing bytes can be modified without detection if both signing and\nverification are performed using the same affected codepath.\n\nThe issue affects only the command-line tool behavior. Verifiers that process\nthe full message using library APIs will reject the signature, so the risk\nprimarily affects workflows that both sign and verify with the affected\n'openssl dgst' command. Streaming digest algorithms for 'openssl dgst' and\nlibrary users are unaffected.\n\nThe FIPS modules in 3.5 and 3.6 are not affected by this issue, as the\ncommand-line tools are outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.5 and 3.6 are vulnerable to this issue.\n\nOpenSSL 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are not affected by this issue.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-15469"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:1473"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-15469"
},
{
"url": "https://bugzilla.redhat.com/2430375"
},
{
"url": "https://bugzilla.redhat.com/2430376"
},
{
"url": "https://bugzilla.redhat.com/2430377"
},
{
"url": "https://bugzilla.redhat.com/2430378"
},
{
"url": "https://bugzilla.redhat.com/2430379"
},
{
"url": "https://bugzilla.redhat.com/2430380"
},
{
"url": "https://bugzilla.redhat.com/2430381"
},
{
"url": "https://bugzilla.redhat.com/2430386"
},
{
"url": "https://bugzilla.redhat.com/2430387"
},
{
"url": "https://bugzilla.redhat.com/2430388"
},
{
"url": "https://bugzilla.redhat.com/2430389"
},
{
"url": "https://bugzilla.redhat.com/2430390"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430375"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430376"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430377"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430378"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430379"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430380"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430381"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430386"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430387"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430388"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430389"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430390"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11187"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15467"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15468"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15469"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66199"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68160"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69418"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69419"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69420"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69421"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22795"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22796"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-1473.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:1473"
},
{
"url": "https://github.com/advisories/GHSA-v2vr-926q-29fr"
},
{
"url": "https://github.com/openssl/openssl/commit/310f305eb92ea8040d6b3cb75a5feeba8e6acf2f"
},
{
"url": "https://github.com/openssl/openssl/commit/a7936fa4bd23c906e1955a16a0a0ab39a4953a61"
},
{
"url": "https://linux.oracle.com/cve/CVE-2025-15469.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2026-50081.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15469"
},
{
"url": "https://openssl-library.org/news/secadv/20260127.txt"
},
{
"url": "https://ubuntu.com/security/notices/USN-7980-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15469"
}
],
"published": "2026-01-27T16:16:14+00:00",
"updated": "2026-02-02T18:37:39+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
}
},
{
"id": "CVE-2025-1632",
"ratings": [
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "nvd"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 3.3,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
404,
476
],
"description": "A vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects the function list of the file bsdunzip.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-1632"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-1632"
},
{
"url": "https://github.com/Ekkosun/pocs/blob/main/bsdunzip-poc"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1632"
},
{
"url": "https://ubuntu.com/security/notices/USN-7454-1"
},
{
"url": "https://vuldb.com/?ctiid.296619"
},
{
"url": "https://vuldb.com/?id.296619"
},
{
"url": "https://vuldb.com/?submit.496460"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-1632"
}
],
"published": "2025-02-24T14:15:11+00:00",
"updated": "2025-03-25T15:41:41+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.3.3-7.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-1795",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "low"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "low"
},
{
"source": {
"name": "photon"
},
"severity": "low"
},
{
"source": {
"name": "redhat"
},
"score": 3.1,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
116
],
"description": "During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded then the separator itself is also unicode-encoded. Expected behavior is that the separating comma remains a plan comma. This can result in the address header being misinterpreted by some mail servers.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-1795"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-1795"
},
{
"url": "https://github.com/python/cpython/commit/09fab93c3d857496c0bd162797fab816c311ee48"
},
{
"url": "https://github.com/python/cpython/commit/70754d21c288535e86070ca7a6e90dcb670b8593"
},
{
"url": "https://github.com/python/cpython/commit/9148b77e0af91cdacaa7fe3dfac09635c3fe9a74"
},
{
"url": "https://github.com/python/cpython/commit/a4ef689ce670684ec132204b1cd03720c8e0a03d"
},
{
"url": "https://github.com/python/cpython/commit/d4df3c55e4c5513947f907f24766b34d2ae8c090"
},
{
"url": "https://github.com/python/cpython/issues/100884"
},
{
"url": "https://github.com/python/cpython/pull/100885"
},
{
"url": "https://github.com/python/cpython/pull/119099"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html"
},
{
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/MB62IZMEC3UM6SGHP5LET5JX2Y7H4ZUR/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1795"
},
{
"url": "https://ubuntu.com/security/notices/USN-7570-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-1795"
}
],
"published": "2025-02-28T19:15:36+00:00",
"updated": "2026-04-15T00:35:42+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-76.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-76.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-25724",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "julia"
},
"score": 4,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"
},
{
"source": {
"name": "nvd"
},
"score": 7.8,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "medium"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 4,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"
},
{
"source": {
"name": "rocky"
},
"severity": "medium"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
252
],
"description": "list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-25724"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:9431"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-25724"
},
{
"url": "https://bugzilla.redhat.com/2349221"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2349221"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-25724"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2025-9431.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2025:9431"
},
{
"url": "https://gist.github.com/Ekkosun/a83870ce7f3b7813b9b462a395e8ad92"
},
{
"url": "https://github.com/Ekkosun/pocs/blob/main/bsdtarbug"
},
{
"url": "https://github.com/advisories/GHSA-722w-734r-qg74"
},
{
"url": "https://github.com/libarchive/libarchive/blob/b439d586f53911c84be5e380445a8a259e19114c/tar/util.c#L751-L752"
},
{
"url": "https://linux.oracle.com/cve/CVE-2025-25724.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2025-9431.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25724"
},
{
"url": "https://ubuntu.com/security/notices/USN-7454-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8147-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-25724"
}
],
"published": "2025-03-02T02:15:36+00:00",
"updated": "2025-07-17T15:56:36+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.3.3-7.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-27113",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "bitnami"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "low"
},
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 3.1,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
476
],
"description": "libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-27113"
},
{
"url": "http://seclists.org/fulldisclosure/2025/Apr/10"
},
{
"url": "http://seclists.org/fulldisclosure/2025/Apr/11"
},
{
"url": "http://seclists.org/fulldisclosure/2025/Apr/12"
},
{
"url": "http://seclists.org/fulldisclosure/2025/Apr/13"
},
{
"url": "http://seclists.org/fulldisclosure/2025/Apr/4"
},
{
"url": "http://seclists.org/fulldisclosure/2025/Apr/5"
},
{
"url": "http://seclists.org/fulldisclosure/2025/Apr/8"
},
{
"url": "http://seclists.org/fulldisclosure/2025/Apr/9"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-27113"
},
{
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/861"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27113"
},
{
"url": "https://security.netapp.com/advisory/ntap-20250306-0004/"
},
{
"url": "https://ubuntu.com/security/notices/USN-7302-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27113"
},
{
"url": "https://www.openwall.com/lists/oss-security/2025/02/18/2"
}
],
"published": "2025-02-18T23:15:10+00:00",
"updated": "2025-11-03T22:18:43+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.9.7-21.el8_10.4",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-30258",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "low"
},
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "nvd"
},
"score": 4.7,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 2.7,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
754
],
"description": "In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a \"verification DoS.\"",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-30258"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-30258"
},
{
"url": "https://dev.gnupg.org/T7527"
},
{
"url": "https://dev.gnupg.org/rG48978ccb4e20866472ef18436a32744350a65158"
},
{
"url": "https://lists.gnupg.org/pipermail/gnupg-announce/2025q1/000491.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30258"
},
{
"url": "https://ubuntu.com/security/notices/USN-7412-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7412-3"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30258"
}
],
"published": "2025-03-19T20:15:20+00:00",
"updated": "2025-10-16T16:53:07+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.2.20-4.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-3360",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "low"
},
{
"source": {
"name": "redhat"
},
"score": 3.7,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
190
],
"description": "A flaw was found in GLib. An integer overflow and buffer under-read occur when parsing a long invalid ISO 8601 timestamp with the g_date_time_new_from_iso8601() function.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-3360"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-3360"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2357754"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/04/msg00024.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3360"
},
{
"url": "https://ubuntu.com/security/notices/USN-7942-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7942-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-3360"
}
],
"published": "2025-04-07T13:15:43+00:00",
"updated": "2026-04-15T00:35:42+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.56.4-169.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-4516",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 5.1,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
416
],
"description": "There is an issue in CPython when using `bytes.decode(\"unicode_escape\", error=\"ignore|replace\")`. If you are not using the \"unicode_escape\" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except catching the DecodeError.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-4516"
},
{
"url": "http://www.openwall.com/lists/oss-security/2025/05/16/4"
},
{
"url": "http://www.openwall.com/lists/oss-security/2025/05/19/1"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:23530"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-4516"
},
{
"url": "https://bugzilla.redhat.com/2294682"
},
{
"url": "https://bugzilla.redhat.com/2321440"
},
{
"url": "https://bugzilla.redhat.com/2325776"
},
{
"url": "https://bugzilla.redhat.com/2343237"
},
{
"url": "https://bugzilla.redhat.com/2366509"
},
{
"url": "https://bugzilla.redhat.com/2370010"
},
{
"url": "https://bugzilla.redhat.com/2370014"
},
{
"url": "https://bugzilla.redhat.com/2370016"
},
{
"url": "https://bugzilla.redhat.com/2372426"
},
{
"url": "https://bugzilla.redhat.com/2373234"
},
{
"url": "https://bugzilla.redhat.com/2402342"
},
{
"url": "https://bugzilla.redhat.com/2408891"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2294682"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2321440"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2325776"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2343237"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2366509"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370010"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370014"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370016"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2372426"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373234"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2402342"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2408891"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-11168"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5642"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-9287"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-0938"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4138"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4330"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4435"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4516"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4517"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6069"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6075"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8291"
},
{
"url": "https://errata.almalinux.org/8/ALSA-2025-23530.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2025:23530"
},
{
"url": "https://github.com/python/cpython/commit/4398b788ffc1f954a2c552da285477d42a571292"
},
{
"url": "https://github.com/python/cpython/commit/5646648678295a44aa82636c6e92826651baf33a"
},
{
"url": "https://github.com/python/cpython/commit/6279eb8c076d89d3739a6edb393e43c7929b429d"
},
{
"url": "https://github.com/python/cpython/commit/69b4387f78f413e8c47572a85b3478c47eba8142"
},
{
"url": "https://github.com/python/cpython/commit/73b3040f592436385007918887b7e2132aa8431f"
},
{
"url": "https://github.com/python/cpython/commit/8d35fd1b34935221aff23a1ab69a429dd156be77"
},
{
"url": "https://github.com/python/cpython/commit/9f69a58623bd01349a18ba0c7a9cb1dad6a51e8e"
},
{
"url": "https://github.com/python/cpython/commit/9f69a58623bd01349a18ba0c7a9cb1dad6a51e8e"
},
{
"url": "https://github.com/python/cpython/commit/ab9893c40609935e0d40a6d2a7307ea51aec598b"
},
{
"url": "https://github.com/python/cpython/issues/133767"
},
{
"url": "https://github.com/python/cpython/pull/129648"
},
{
"url": "https://linux.oracle.com/cve/CVE-2025-4516.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2025-23530.html"
},
{
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/L75IPBBTSCYEF56I2M4KIW353BB3AY74/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4516"
},
{
"url": "https://ubuntu.com/security/notices/USN-7570-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-4516"
}
],
"published": "2025-05-15T14:15:31+00:00",
"updated": "2026-04-15T00:35:42+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-76.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-76.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-45582",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.6,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"source": {
"name": "rocky"
},
"severity": "medium"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
24
],
"description": "GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file, specified via a relative pathname that begins with the symlink name and ends with that critical file's name. Here, the extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of \"Member name contains '..'\" that would occur for a single TAR archive that attempted to specify the critical file via a ../ approach. For example, the first archive can contain \"x -> ../../../../../home/victim/.ssh\" and the second archive can contain x/authorized_keys. This can affect server applications that automatically extract any number of user-supplied TAR archives, and were relying on the blocking of traversal. This can also affect software installation processes in which \"tar xf\" is run more than once (e.g., when installing a package can automatically install two dependencies that are set up as untrusted tarballs instead of official packages). NOTE: the official GNU Tar manual has an otherwise-empty directory for each \"tar xf\" in its Security Rules of Thumb; however, third-party advice leads users to run \"tar xf\" more than once into the same directory.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-45582"
},
{
"url": "http://www.openwall.com/lists/oss-security/2025/11/01/6"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:0067"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-45582"
},
{
"url": "https://bugzilla.redhat.com/2379592"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379592"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-45582"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-0067.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:0067"
},
{
"url": "https://github.com/i900008/vulndb/blob/main/Gnu_tar_vuln.md"
},
{
"url": "https://linux.oracle.com/cve/CVE-2025-45582.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2026-0067.html"
},
{
"url": "https://lists.gnu.org/archive/html/bug-tar/2025-08/msg00012.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-45582"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-45582"
},
{
"url": "https://www.gnu.org/software/tar/"
},
{
"url": "https://www.gnu.org/software/tar/manual/html_node/Integrity.html"
},
{
"url": "https://www.gnu.org/software/tar/manual/html_node/Integrity.html#Integrity"
},
{
"url": "https://www.gnu.org/software/tar/manual/html_node/Security-rules-of-thumb.html"
}
],
"published": "2025-07-11T17:15:37+00:00",
"updated": "2025-11-02T01:15:32+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2",
"versions": [
{
"version": "2:1.30-11.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
}
},
{
"id": "CVE-2025-4598",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "medium"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 4.7,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "rocky"
},
"severity": "medium"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
364
],
"description": "A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process.\n\nA SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-4598"
},
{
"url": "http://seclists.org/fulldisclosure/2025/Jun/9"
},
{
"url": "http://www.openwall.com/lists/oss-security/2025/06/05/1"
},
{
"url": "http://www.openwall.com/lists/oss-security/2025/06/05/3"
},
{
"url": "http://www.openwall.com/lists/oss-security/2025/08/18/3"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:22660"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:22868"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:23227"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:23234"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:0414"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:1652"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:18153"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-4598"
},
{
"url": "https://blogs.oracle.com/linux/post/analysis-of-cve-2025-4598"
},
{
"url": "https://bugzilla.redhat.com/2369242"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2369242"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"url": "https://ciq.com/blog/the-real-danger-of-systemd-coredump-cve-2025-4598/"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4598"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2025-22660.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2025:22660"
},
{
"url": "https://git.kernel.org/linus/b5325b2a270fcaf7b2a9a0f23d422ca8a5a8bdea"
},
{
"url": "https://github.com/systemd/systemd/commit/0c49e0049b7665bb7769a13ef346fef92e1ad4d6"
},
{
"url": "https://github.com/systemd/systemd/commit/13902e025321242b1d95c6d8b4e482b37f58cdef"
},
{
"url": "https://github.com/systemd/systemd/commit/49f1f2d4a7612bbed5211a73d11d6a94fbe3bb69"
},
{
"url": "https://github.com/systemd/systemd/commit/76e0ab49c47965877c19772a2b3bf55f6417ca39"
},
{
"url": "https://github.com/systemd/systemd/commit/868d95577ec9f862580ad365726515459be582fc"
},
{
"url": "https://github.com/systemd/systemd/commit/8fc7b2a211eb13ef1a94250b28e1c79cab8bdcb9"
},
{
"url": "https://github.com/systemd/systemd/commit/9ce8e3e449def92c75ada41b7d10c5bc3946be77"
},
{
"url": "https://github.com/systemd/systemd/commit/e6a8687b939ab21854f12f59a3cce703e32768cf"
},
{
"url": "https://linux.oracle.com/cve/CVE-2025-4598.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2025-22660.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00022.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4598"
},
{
"url": "https://ubuntu.com/security/notices/USN-7559-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-4598"
},
{
"url": "https://www.openwall.com/lists/oss-security/2025/05/29/3"
},
{
"url": "https://www.openwall.com/lists/oss-security/2025/08/18/3"
},
{
"url": "https://www.qualys.com/2025/05/29/apport-coredump/apport-coredump.txt"
}
],
"published": "2025-05-30T14:15:23+00:00",
"updated": "2026-05-19T16:16:18+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "239-82.el8_10.16",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "239-82.el8_10.16",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "239-82.el8_10.16",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
}
},
{
"id": "CVE-2025-47268",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "medium"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
},
{
"source": {
"name": "rocky"
},
"severity": "medium"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
190
],
"description": "ping in iputils before 20250602 allows a denial of service (application error or incorrect data collection) via a crafted ICMP Echo Reply packet, because of a signed 64-bit integer overflow in timestamp multiplication.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-47268"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:9432"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-47268"
},
{
"url": "https://bugzilla.redhat.com/2364090"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2364090"
},
{
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1242300"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-47268"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2025-9432.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2025:9432"
},
{
"url": "https://github.com/Zephkek/ping-rtt-overflow/"
},
{
"url": "https://github.com/iputils/iputils/commit/070cfacd7348386173231fb16fad4983d4e6ae40"
},
{
"url": "https://github.com/iputils/iputils/issues/584"
},
{
"url": "https://github.com/iputils/iputils/pull/585"
},
{
"url": "https://github.com/iputils/iputils/releases/tag/20250602"
},
{
"url": "https://linux.oracle.com/cve/CVE-2025-47268.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2025-9432.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47268"
},
{
"url": "https://ubuntu.com/security/notices/USN-7670-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-47268"
}
],
"published": "2025-05-05T14:15:29+00:00",
"updated": "2026-04-06T14:12:20+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "20180629-11.el8",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
}
},
{
"id": "CVE-2025-4878",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "low"
},
{
"source": {
"name": "photon"
},
"severity": "low"
},
{
"source": {
"name": "redhat"
},
"score": 3.6,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
},
{
"source": {
"name": "rocky"
},
"severity": "medium"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
416
],
"description": "A vulnerability was found in libssh, where an uninitialized variable exists under certain conditions in the privatekey_from_file() function. This flaw can be triggered if the file specified by the filename doesn't exist and may lead to possible signing failures or heap corruption.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-4878"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:18683"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-4878"
},
{
"url": "https://bugzilla.redhat.com/2369367"
},
{
"url": "https://bugzilla.redhat.com/2376184"
},
{
"url": "https://bugzilla.redhat.com/2376193"
},
{
"url": "https://bugzilla.redhat.com/2383220"
},
{
"url": "https://bugzilla.redhat.com/2383888"
},
{
"url": "https://bugzilla.redhat.com/2433121"
},
{
"url": "https://bugzilla.redhat.com/2436979"
},
{
"url": "https://bugzilla.redhat.com/2436980"
},
{
"url": "https://bugzilla.redhat.com/2436981"
},
{
"url": "https://bugzilla.redhat.com/2436982"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2369367"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2376184"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2376193"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2383220"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2383888"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433121"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436979"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436980"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436981"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436982"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4877"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4878"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5351"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8114"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8277"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0964"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0965"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0966"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0967"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0968"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-18683.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:18683"
},
{
"url": "https://git.libssh.org/projects/libssh.git/commit/?id=697650caa97eaf7623924c75f9fcfec6dd423cd1"
},
{
"url": "https://git.libssh.org/projects/libssh.git/commit/?id=b35ee876adc92a208d47194772e99f9c71e0bedb"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4878"
},
{
"url": "https://ubuntu.com/security/notices/USN-7619-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7696-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-4878"
},
{
"url": "https://www.libssh.org/security/advisories/CVE-2025-4878.txt"
}
],
"published": "2025-07-22T15:15:36+00:00",
"updated": "2026-05-19T14:16:28+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "0.9.6-16.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "0.9.6-16.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-48964",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "medium"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "rocky"
},
"severity": "medium"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
190
],
"description": "ping in iputils before 20250602 allows a denial of service (application error in adaptive ping mode or incorrect data collection) via a crafted ICMP Echo Reply packet, because a zero timestamp can lead to large intermediate values that have an integer overflow when squared during statistics calculations. NOTE: this issue exists because of an incomplete fix for CVE-2025-47268 (that fix was only about timestamp calculations, and it did not account for a specific scenario where the original timestamp in the ICMP payload is zero).",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-48964"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:17558"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-48964"
},
{
"url": "https://bugzilla.redhat.com/2382657"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2382657"
},
{
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1243772"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48964"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2025-17558.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2025:17558"
},
{
"url": "https://github.com/iputils/iputils/commit/afa36390394a6e0cceba03b52b59b6d41710608c"
},
{
"url": "https://github.com/iputils/iputils/issues"
},
{
"url": "https://github.com/iputils/iputils/releases/tag/20250602"
},
{
"url": "https://github.com/iputils/iputils/security/advisories/GHSA-25fr-jw29-74f9"
},
{
"url": "https://linux.oracle.com/cve/CVE-2025-48964.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2025-17558.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48964"
},
{
"url": "https://ubuntu.com/security/notices/USN-7670-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48964"
}
],
"published": "2025-07-22T18:15:36+00:00",
"updated": "2026-04-15T00:35:42+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "20180629-11.el8",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-50181",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "ghsa"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "nvd"
},
"score": 6.1,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
601
],
"description": "urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-50181"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-50181"
},
{
"url": "https://github.com/urllib3/urllib3"
},
{
"url": "https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857"
},
{
"url": "https://github.com/urllib3/urllib3/releases/tag/2.5.0"
},
{
"url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-pq67-6m6q-mj2v"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-50181"
},
{
"url": "https://ubuntu.com/security/notices/USN-7599-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7599-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-50181"
}
],
"published": "2025-06-19T01:15:24+00:00",
"updated": "2025-12-22T19:15:49+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "9.0.3-24.el8",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "9.0.3-24.el8",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
}
]
},
{
"id": "CVE-2025-50182",
"ratings": [
{
"source": {
"name": "ghsa"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "nvd"
},
"score": 6.1,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
{
"source": {
"name": "redhat"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
601
],
"description": "urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodide; the runtime itself determines redirect behavior. This issue has been patched in version 2.5.0.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-50182"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-50182"
},
{
"url": "https://github.com/urllib3/urllib3"
},
{
"url": "https://github.com/urllib3/urllib3/commit/7eb4a2aafe49a279c29b6d1f0ed0f42e9736194f"
},
{
"url": "https://github.com/urllib3/urllib3/releases/tag/2.5.0"
},
{
"url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-48p4-8xcf-vxj5"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-50182"
},
{
"url": "https://ubuntu.com/security/notices/USN-7599-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-50182"
}
],
"published": "2025-06-19T02:15:17+00:00",
"updated": "2025-12-22T19:15:49+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "9.0.3-24.el8",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "9.0.3-24.el8",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
}
},
{
"id": "CVE-2025-5278",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 4.4,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L"
}
],
"cwes": [
121
],
"description": "A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-5278"
},
{
"url": "http://www.openwall.com/lists/oss-security/2025/05/27/2"
},
{
"url": "http://www.openwall.com/lists/oss-security/2025/05/29/1"
},
{
"url": "http://www.openwall.com/lists/oss-security/2025/05/29/2"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-5278"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2368764"
},
{
"url": "https://cgit.git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8c9602e3a145e9596dc1a63c6ed67865814b6633"
},
{
"url": "https://cgit.git.savannah.gnu.org/cgit/coreutils.git/tree/NEWS?id=8c9602e3a145e9596dc1a63c6ed67865814b6633#n14"
},
{
"url": "https://debbugs.gnu.org/cgi/bugreport.cgi?bug=78507"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5278"
},
{
"url": "https://security-tracker.debian.org/tracker/CVE-2025-5278"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-5278"
}
],
"published": "2025-05-27T21:15:23+00:00",
"updated": "2026-05-19T17:16:21+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/coreutils-single@8.30-17.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "8.30-17.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/coreutils-single@8.30-17.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/coreutils-single@8.30-17.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/coreutils-single@8.30-17.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/coreutils-single@8.30-17.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/coreutils-single@8.30-17.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/coreutils-single@8.30-17.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/coreutils-single@8.30-17.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/coreutils-single@8.30-17.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/coreutils-single@8.30-17.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/coreutils-single@8.30-17.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/coreutils-single@8.30-17.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/coreutils-single@8.30-17.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/coreutils-single@8.30-17.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/coreutils-single@8.30-17.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/coreutils-single@8.30-17.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/coreutils-single@8.30-17.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/coreutils-single@8.30-17.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/coreutils-single@8.30-17.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/coreutils-single@8.30-17.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/coreutils-single@8.30-17.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/coreutils-single@8.30-17.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-5351",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "rocky"
},
"severity": "medium"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
415
],
"description": "A flaw was found in the key export functionality of libssh. The issue occurs in the internal function responsible for converting cryptographic keys into serialized formats. During error handling, a memory structure is freed but not cleared, leading to a potential double free issue if an additional failure occurs later in the function. This condition may result in heap corruption or application instability in low-memory scenarios, posing a risk to system reliability where key export operations are performed.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-5351"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:18683"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-5351"
},
{
"url": "https://bugzilla.redhat.com/2369367"
},
{
"url": "https://bugzilla.redhat.com/2376184"
},
{
"url": "https://bugzilla.redhat.com/2376193"
},
{
"url": "https://bugzilla.redhat.com/2383220"
},
{
"url": "https://bugzilla.redhat.com/2383888"
},
{
"url": "https://bugzilla.redhat.com/2433121"
},
{
"url": "https://bugzilla.redhat.com/2436979"
},
{
"url": "https://bugzilla.redhat.com/2436980"
},
{
"url": "https://bugzilla.redhat.com/2436981"
},
{
"url": "https://bugzilla.redhat.com/2436982"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2369367"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2376184"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2376193"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2383220"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2383888"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433121"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436979"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436980"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436981"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436982"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4877"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4878"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5351"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8114"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8277"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0964"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0965"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0966"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0967"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0968"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-18683.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:18683"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5351"
},
{
"url": "https://ubuntu.com/security/notices/USN-7619-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-5351"
},
{
"url": "https://www.libssh.org/security/advisories/CVE-2025-5351.txt"
}
],
"published": "2025-07-04T09:15:37+00:00",
"updated": "2026-05-19T14:16:28+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "0.9.6-16.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "0.9.6-16.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-5915",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "low"
},
{
"source": {
"name": "nvd"
},
"score": 6.6,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 6.6,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
122
],
"description": "A vulnerability has been identified in the libarchive library. This flaw can lead to a heap buffer over-read due to the size of a filter block potentially exceeding the Lempel-Ziv-Storer-Schieber (LZSS) window. This means the library may attempt to read beyond the allocated memory buffer, which can result in unpredictable program behavior, crashes (denial of service), or the disclosure of sensitive information from adjacent memory regions.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-5915"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-5915"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370865"
},
{
"url": "https://github.com/libarchive/libarchive/pull/2599"
},
{
"url": "https://github.com/libarchive/libarchive/releases/tag/v3.8.0"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5915"
},
{
"url": "https://ubuntu.com/security/notices/USN-7601-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-5915"
}
],
"published": "2025-06-09T20:15:26+00:00",
"updated": "2026-01-08T04:15:55+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.3.3-7.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-5916",
"ratings": [
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "low"
},
{
"source": {
"name": "nvd"
},
"score": 5.6,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 3.9,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
190
],
"description": "A vulnerability has been identified in the libarchive library. This flaw involves an integer overflow that can be triggered when processing a Web Archive (WARC) file that claims to have more than INT64_MAX - 4 content bytes. An attacker could craft a malicious WARC archive to induce this overflow, potentially leading to unpredictable program behavior, memory corruption, or a denial-of-service condition within applications that process such archives using libarchive. This bug affects libarchive versions prior to 3.8.0.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-5916"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-5916"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370872"
},
{
"url": "https://github.com/libarchive/libarchive/pull/2568"
},
{
"url": "https://github.com/libarchive/libarchive/pull/2568/commits/bce70c4c26864df2a8d6953e7db6e4b156253508"
},
{
"url": "https://github.com/libarchive/libarchive/releases/tag/v3.8.0"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5916"
},
{
"url": "https://ubuntu.com/security/notices/USN-7601-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8147-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-5916"
}
],
"published": "2025-06-09T20:15:27+00:00",
"updated": "2025-12-12T01:15:46+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.3.3-7.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-5917",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "low"
},
{
"source": {
"name": "nvd"
},
"score": 5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 2.8,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
787
],
"description": "A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by-one' miscalculation when handling prefixes and suffixes for file names. This can lead to a 1-byte write overflow. While seemingly small, such an overflow can corrupt adjacent memory, leading to unpredictable program behavior, crashes, or in specific circumstances, could be leveraged as a building block for more sophisticated exploitation. This bug affects libarchive versions prior to 3.8.0.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-5917"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-5917"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370874"
},
{
"url": "https://github.com/libarchive/libarchive/pull/2588"
},
{
"url": "https://github.com/libarchive/libarchive/releases/tag/v3.8.0"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5917"
},
{
"url": "https://ubuntu.com/security/notices/USN-7601-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8147-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-5917"
}
],
"published": "2025-06-09T20:15:27+00:00",
"updated": "2025-12-12T01:15:46+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.3.3-7.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-5918",
"ratings": [
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "low"
},
{
"source": {
"name": "nvd"
},
"score": 6.6,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 3.9,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
125
],
"description": "A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-bounds read can lead to unintended consequences, including unpredictable program behavior, memory corruption, or a denial-of-service condition.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-5918"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-5918"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370877"
},
{
"url": "https://github.com/libarchive/libarchive/pull/2584"
},
{
"url": "https://github.com/libarchive/libarchive/releases/tag/v3.8.0"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5918"
},
{
"url": "https://ubuntu.com/security/notices/USN-8147-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-5918"
}
],
"published": "2025-06-09T20:15:27+00:00",
"updated": "2025-08-15T18:35:04+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.3.3-7.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-6069",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "bitnami"
},
"score": 4.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 4.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "rocky"
},
"severity": "medium"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
1333
],
"description": "The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-6069"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:23342"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-6069"
},
{
"url": "https://bugzilla.redhat.com/2294682"
},
{
"url": "https://bugzilla.redhat.com/2373234"
},
{
"url": "https://bugzilla.redhat.com/2402342"
},
{
"url": "https://bugzilla.redhat.com/2408891"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2294682"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373234"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2402342"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2408891"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5642"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6069"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6075"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8291"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2025-23342.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2025:23342"
},
{
"url": "https://github.com/python/cpython/commit/4455cbabf991e202185a25a631af206f60bbc949"
},
{
"url": "https://github.com/python/cpython/commit/6eb6c5dbfb528bd07d77b60fd71fd05d81d45c41"
},
{
"url": "https://github.com/python/cpython/commit/6eb6c5dbfb528bd07d77b60fd71fd05d81d45c41"
},
{
"url": "https://github.com/python/cpython/commit/8d1b3dfa09135affbbf27fb8babcf3c11415df49"
},
{
"url": "https://github.com/python/cpython/commit/ab0893fd5c579d9cea30841680e6d35fc478afb5"
},
{
"url": "https://github.com/python/cpython/commit/d851f8e258c7328814943e923a7df81bca15df4b"
},
{
"url": "https://github.com/python/cpython/commit/f3c6f882cddc8dc30320d2e73edf019e201394fc"
},
{
"url": "https://github.com/python/cpython/commit/fdc9d214c01cb4588f540cfa03726bbf2a33fc15"
},
{
"url": "https://github.com/python/cpython/issues/135462"
},
{
"url": "https://github.com/python/cpython/pull/135464"
},
{
"url": "https://linux.oracle.com/cve/CVE-2025-6069.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2025-23530.html"
},
{
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/K5PIYLR6EP3WR7ZOKKYQUWEDNQVUXOYM/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6069"
},
{
"url": "https://ubuntu.com/security/notices/USN-7710-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-6069"
}
],
"published": "2025-06-17T14:15:33+00:00",
"updated": "2026-04-15T00:35:42+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-76.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-76.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-6075",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "amazon"
},
"severity": "low"
},
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "low"
},
{
"source": {
"name": "nvd"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 4,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "rocky"
},
"severity": "medium"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
400
],
"description": "If the value passed to os.path.expandvars() is user-controlled a \nperformance degradation is possible when expanding environment \nvariables.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-6075"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:19177"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-6075"
},
{
"url": "https://bugzilla.redhat.com/2395108"
},
{
"url": "https://bugzilla.redhat.com/2408891"
},
{
"url": "https://bugzilla.redhat.com/2418084"
},
{
"url": "https://bugzilla.redhat.com/2431366"
},
{
"url": "https://bugzilla.redhat.com/2431374"
},
{
"url": "https://bugzilla.redhat.com/2444691"
},
{
"url": "https://bugzilla.redhat.com/2448168"
},
{
"url": "https://bugzilla.redhat.com/2448181"
},
{
"url": "https://bugzilla.redhat.com/2449649"
},
{
"url": "https://bugzilla.redhat.com/2457409"
},
{
"url": "https://bugzilla.redhat.com/2457932"
},
{
"url": "https://bugzilla.redhat.com/2458049"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2294682"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373234"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2402342"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2408891"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5642"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6069"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6075"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8291"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-19177.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2025:23342"
},
{
"url": "https://github.com/python/cpython/commit/2e6150adccaaf5bd95d4c19dfd04a36e0b325d8c"
},
{
"url": "https://github.com/python/cpython/commit/5dceb93486176e6b4a6d9754491005113eb23427"
},
{
"url": "https://github.com/python/cpython/commit/631ba3407e3348ccd56ce5160c4fb2c5dc5f4d84"
},
{
"url": "https://github.com/python/cpython/commit/892747b4cf0f95ba8beb51c0d0658bfaa381ebca"
},
{
"url": "https://github.com/python/cpython/commit/9ab89c026aa9611c4b0b67c288b8303a480fe742"
},
{
"url": "https://github.com/python/cpython/commit/c8a5f3435c342964e0a432cc9fb448b7dbecd1ba"
},
{
"url": "https://github.com/python/cpython/commit/f029e8db626ddc6e3a3beea4eff511a71aaceb5c"
},
{
"url": "https://github.com/python/cpython/issues/136065"
},
{
"url": "https://linux.oracle.com/cve/CVE-2025-6075.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2026-10950.html"
},
{
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/IUP5QJ6D4KK6ULHOMPC7DPNKRYQTQNLA/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6075"
},
{
"url": "https://ubuntu.com/security/notices/USN-7886-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7886-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-6075"
}
],
"published": "2025-10-31T17:15:48+00:00",
"updated": "2026-02-04T19:05:15+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-76.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-76.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
}
},
{
"id": "CVE-2025-60753",
"ratings": [
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
400,
835
],
"description": "An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash).",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-60753"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-60753"
},
{
"url": "https://github.com/Papya-j/CVE/tree/main/CVE-2025-60753"
},
{
"url": "https://github.com/libarchive/libarchive/issues/2725"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-60753"
},
{
"url": "https://ubuntu.com/security/notices/USN-8147-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-60753"
}
],
"published": "2025-11-05T16:15:40+00:00",
"updated": "2026-02-04T21:19:45+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.3.3-7.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-6170",
"ratings": [
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "low"
},
{
"source": {
"name": "nvd"
},
"score": 2.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "photon"
},
"severity": "low"
},
{
"source": {
"name": "redhat"
},
"score": 2.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
121
],
"description": "A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program does not check the input size properly, which can cause it to crash. This issue might allow attackers to run harmful code in rare configurations without modern protections.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-6170"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:7519"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-6170"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2372952"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
},
{
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/941"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00014.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6170"
},
{
"url": "https://ubuntu.com/security/notices/USN-7694-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-6170"
}
],
"published": "2025-06-16T16:15:20+00:00",
"updated": "2026-06-02T14:16:38+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.9.7-21.el8_10.4",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-64118",
"ratings": [
{
"source": {
"name": "redhat"
},
"score": 4.7,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"cwes": [
362,
367
],
"description": "node-tar is a Tar for Node.js. In 7.5.1, using .t (aka .list) with { sync: true } to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read. This vulnerability is fixed in 7.5.2.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-64118"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-64118"
},
{
"url": "https://github.com/isaacs/node-tar"
},
{
"url": "https://github.com/isaacs/node-tar/commit/5330eb04bc43014f216e5c271b40d5c00d45224d"
},
{
"url": "https://github.com/isaacs/node-tar/commit/5e1a8e638600d3c3a2969b4de6a6ec44fa8d74c9"
},
{
"url": "https://github.com/isaacs/node-tar/issues/445"
},
{
"url": "https://github.com/isaacs/node-tar/pull/446"
},
{
"url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-29xp-372q-xqph"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64118"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-64118"
}
],
"published": "2025-10-30T18:15:33+00:00",
"updated": "2026-04-15T00:35:42+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2",
"versions": [
{
"version": "2:1.30-11.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-66382",
"ratings": [
{
"source": {
"name": "nvd"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 2.9,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
407
],
"description": "In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-66382"
},
{
"url": "http://www.openwall.com/lists/oss-security/2025/12/02/1"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-66382"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
},
{
"url": "https://github.com/libexpat/libexpat/issues/1076"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66382"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-66382"
}
],
"published": "2025-11-28T07:15:57+00:00",
"updated": "2026-06-02T14:16:37+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.5.0-2.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-68160",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "julia"
},
"score": 4.7,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 4.7,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
787
],
"description": "Issue summary: Writing large, newline-free data into a BIO chain using the\nline-buffering filter where the next BIO performs short writes can trigger\na heap-based out-of-bounds write.\n\nImpact summary: This out-of-bounds write can cause memory corruption which\ntypically results in a crash, leading to Denial of Service for an application.\n\nThe line-buffering BIO filter (BIO_f_linebuffer) is not used by default in\nTLS/SSL data paths. In OpenSSL command-line applications, it is typically\nonly pushed onto stdout/stderr on VMS systems. Third-party applications that\nexplicitly use this filter with a BIO chain that can short-write and that\nwrite large, newline-free data influenced by an attacker would be affected.\nHowever, the circumstances where this could happen are unlikely to be under\nattacker control, and BIO_f_linebuffer is unlikely to be handling non-curated\ndata controlled by an attacker. For that reason the issue was assessed as\nLow severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the BIO implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-68160"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:1473"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-68160"
},
{
"url": "https://bugzilla.redhat.com/2430375"
},
{
"url": "https://bugzilla.redhat.com/2430376"
},
{
"url": "https://bugzilla.redhat.com/2430377"
},
{
"url": "https://bugzilla.redhat.com/2430378"
},
{
"url": "https://bugzilla.redhat.com/2430379"
},
{
"url": "https://bugzilla.redhat.com/2430380"
},
{
"url": "https://bugzilla.redhat.com/2430381"
},
{
"url": "https://bugzilla.redhat.com/2430386"
},
{
"url": "https://bugzilla.redhat.com/2430387"
},
{
"url": "https://bugzilla.redhat.com/2430388"
},
{
"url": "https://bugzilla.redhat.com/2430389"
},
{
"url": "https://bugzilla.redhat.com/2430390"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430375"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430376"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430377"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430378"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430379"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430380"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430381"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430386"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430387"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430388"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430389"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430390"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11187"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15467"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15468"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15469"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66199"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68160"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69418"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69419"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69420"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69421"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22795"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22796"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-1473.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:1473"
},
{
"url": "https://github.com/advisories/GHSA-g78j-46j5-97cr"
},
{
"url": "https://github.com/openssl/openssl/commit/384011202af92605d926fafe4a0bcd6b65d162ad"
},
{
"url": "https://github.com/openssl/openssl/commit/475c466ef2fbd8fc1df6fae1c3eed9c813fc8ff6"
},
{
"url": "https://github.com/openssl/openssl/commit/4c96fbba618e1940f038012506ee9e21d32ee12c"
},
{
"url": "https://github.com/openssl/openssl/commit/6845c3b6460a98b1ec4e463baa2ea1a63a32d7c0"
},
{
"url": "https://github.com/openssl/openssl/commit/68a7cd2e2816c3a02f4d45a2ce43fc04fac97096"
},
{
"url": "https://linux.oracle.com/cve/CVE-2025-68160.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2026-50081.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68160"
},
{
"url": "https://openssl-library.org/news/secadv/20260127.txt"
},
{
"url": "https://ubuntu.com/security/notices/USN-7980-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7980-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68160"
}
],
"published": "2026-01-27T16:16:15+00:00",
"updated": "2026-05-12T13:17:24+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
}
},
{
"id": "CVE-2025-68972",
"ratings": [
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "julia"
},
"score": 5.9,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N"
},
{
"source": {
"name": "nvd"
},
"score": 4.7,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N"
},
{
"source": {
"name": "redhat"
},
"score": 5.9,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N"
}
],
"cwes": [
347
],
"description": "In GnuPG through 2.4.8, if a signed message has \\f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an \"invalid armor\" message is printed during verification). This is related to use of \\f as a marker to denote truncation of a long plaintext line.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-68972"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-68972"
},
{
"url": "https://github.com/advisories/GHSA-w789-3q45-984r"
},
{
"url": "https://gpg.fail/formfeed"
},
{
"url": "https://media.ccc.de/v/39c3-to-sign-or-not-to-sign-practical-vulnerabilities-i"
},
{
"url": "https://news.ycombinator.com/item?id=46404339"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68972"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68972"
}
],
"published": "2025-12-27T23:15:40+00:00",
"updated": "2026-01-09T20:08:47+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.2.20-4.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-69418",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "julia"
},
"score": 4,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 4,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
325
],
"description": "Issue summary: When using the low-level OCB API directly with AES-NI or
other hardware-accelerated code paths, inputs whose length is not a multiple
of 16 bytes can leave the final partial block unencrypted and unauthenticated.
Impact summary: The trailing 1-15 bytes of a message may be exposed in
cleartext on encryption and are not covered by the authentication tag,
allowing an attacker to read or tamper with those bytes without detection.
The low-level OCB encrypt and decrypt routines in the hardware-accelerated
stream path process full 16-byte blocks but do not advance the input/output
pointers. The subsequent tail-handling code then operates on the original
base pointers, effectively reprocessing the beginning of the buffer while
leaving the actual trailing bytes unprocessed. The authentication checksum
also excludes the true tail bytes.
However, typical OpenSSL consumers using EVP are not affected because the
higher-level EVP and provider OCB implementations split inputs so that full
blocks and trailing partial blocks are processed in separate calls, avoiding
the problematic code path. Additionally, TLS does not use OCB ciphersuites.
The vulnerability only affects applications that call the low-level
CRYPTO_ocb128_encrypt() or CRYPTO_ocb128_decrypt() functions directly with
non-block-aligned lengths in a single call on hardware-accelerated builds.
For these reasons the issue was assessed as Low severity.
The FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected
by this issue, as OCB mode is not a FIPS-approved algorithm.
OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.
OpenSSL 1.0.2 is not affected by this issue.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-69418"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:1473"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-69418"
},
{
"url": "https://bugzilla.redhat.com/2430375"
},
{
"url": "https://bugzilla.redhat.com/2430376"
},
{
"url": "https://bugzilla.redhat.com/2430377"
},
{
"url": "https://bugzilla.redhat.com/2430378"
},
{
"url": "https://bugzilla.redhat.com/2430379"
},
{
"url": "https://bugzilla.redhat.com/2430380"
},
{
"url": "https://bugzilla.redhat.com/2430381"
},
{
"url": "https://bugzilla.redhat.com/2430386"
},
{
"url": "https://bugzilla.redhat.com/2430387"
},
{
"url": "https://bugzilla.redhat.com/2430388"
},
{
"url": "https://bugzilla.redhat.com/2430389"
},
{
"url": "https://bugzilla.redhat.com/2430390"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430375"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430376"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430377"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430378"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430379"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430380"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430381"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430386"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430387"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430388"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430389"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430390"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11187"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15467"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15468"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15469"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66199"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68160"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69418"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69419"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69420"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69421"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22795"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22796"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-1473.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:1473"
},
{
"url": "https://github.com/advisories/GHSA-78qr-24v5-7q73"
},
{
"url": "https://github.com/openssl/openssl/commit/372fc5c77529695b05b4f5b5187691a57ef5dffc"
},
{
"url": "https://github.com/openssl/openssl/commit/4016975d4469cd6b94927c607f7c511385f928d8"
},
{
"url": "https://github.com/openssl/openssl/commit/52d23c86a54adab5ee9f80e48b242b52c4cc2347"
},
{
"url": "https://github.com/openssl/openssl/commit/a7589230356d908c0eca4b969ec4f62106f4f5ae"
},
{
"url": "https://github.com/openssl/openssl/commit/ed40856d7d4ba6cb42779b6770666a65f19cb977"
},
{
"url": "https://linux.oracle.com/cve/CVE-2025-69418.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2026-50081.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69418"
},
{
"url": "https://openssl-library.org/news/secadv/20260127.txt"
},
{
"url": "https://ubuntu.com/security/notices/USN-7980-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7980-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-69418"
}
],
"published": "2026-01-27T16:16:33+00:00",
"updated": "2026-05-12T13:17:24+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
}
},
{
"id": "CVE-2025-69420",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "azure"
},
"severity": "high"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "high"
},
{
"source": {
"name": "julia"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 5.9,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
754
],
"description": "Issue summary: A type confusion vulnerability exists in the TimeStamp Response\nverification code where an ASN1_TYPE union member is accessed without first\nvalidating the type, causing an invalid or NULL pointer dereference when\nprocessing a malformed TimeStamp Response file.\n\nImpact summary: An application calling TS_RESP_verify_response() with a\nmalformed TimeStamp Response can be caused to dereference an invalid or\nNULL pointer when reading, resulting in a Denial of Service.\n\nThe functions ossl_ess_get_signing_cert() and ossl_ess_get_signing_cert_v2()\naccess the signing cert attribute value without validating its type.\nWhen the type is not V_ASN1_SEQUENCE, this results in accessing invalid memory\nthrough the ASN1_TYPE union, causing a crash.\n\nExploiting this vulnerability requires an attacker to provide a malformed\nTimeStamp Response to an application that verifies timestamp responses. The\nTimeStamp protocol (RFC 3161) is not widely used and the impact of the\nexploit is just a Denial of Service. For these reasons the issue was\nassessed as Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the TimeStamp Response implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.\n\nOpenSSL 1.0.2 is not affected by this issue.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-69420"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:1473"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-69420"
},
{
"url": "https://bugzilla.redhat.com/2430375"
},
{
"url": "https://bugzilla.redhat.com/2430376"
},
{
"url": "https://bugzilla.redhat.com/2430377"
},
{
"url": "https://bugzilla.redhat.com/2430378"
},
{
"url": "https://bugzilla.redhat.com/2430379"
},
{
"url": "https://bugzilla.redhat.com/2430380"
},
{
"url": "https://bugzilla.redhat.com/2430381"
},
{
"url": "https://bugzilla.redhat.com/2430386"
},
{
"url": "https://bugzilla.redhat.com/2430387"
},
{
"url": "https://bugzilla.redhat.com/2430388"
},
{
"url": "https://bugzilla.redhat.com/2430389"
},
{
"url": "https://bugzilla.redhat.com/2430390"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430375"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430376"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430377"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430378"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430379"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430380"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430381"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430386"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430387"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430388"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430389"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430390"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11187"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15467"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15468"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15469"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66199"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68160"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69418"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69419"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69420"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69421"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22795"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22796"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-1473.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:1473"
},
{
"url": "https://github.com/advisories/GHSA-w42r-ph9f-9x66"
},
{
"url": "https://github.com/openssl/openssl/commit/27c7012c91cc986a598d7540f3079dfde2416eb9"
},
{
"url": "https://github.com/openssl/openssl/commit/4e254b48ad93cc092be3dd62d97015f33f73133a"
},
{
"url": "https://github.com/openssl/openssl/commit/564fd9c73787f25693bf9e75faf7bf6bb1305d4e"
},
{
"url": "https://github.com/openssl/openssl/commit/5eb0770ffcf11b785cf374ff3c19196245e54f1b"
},
{
"url": "https://github.com/openssl/openssl/commit/a99349ebfc519999edc50620abe24d599b9eb085"
},
{
"url": "https://linux.oracle.com/cve/CVE-2025-69420.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2026-50081.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69420"
},
{
"url": "https://openssl-library.org/news/secadv/20260127.txt"
},
{
"url": "https://ubuntu.com/security/notices/USN-7980-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7980-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-69420"
}
],
"published": "2026-01-27T16:16:34+00:00",
"updated": "2026-05-12T13:17:26+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
}
},
{
"id": "CVE-2025-69421",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "julia"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 6.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
476
],
"description": "Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer\ndereference in the PKCS12_item_decrypt_d2i_ex() function.\n\nImpact summary: A NULL pointer dereference can trigger a crash which leads to\nDenial of Service for an application processing PKCS#12 files.\n\nThe PKCS12_item_decrypt_d2i_ex() function does not check whether the oct\nparameter is NULL before dereferencing it. When called from\nPKCS12_unpack_p7encdata() with a malformed PKCS#12 file, this parameter can\nbe NULL, causing a crash. The vulnerability is limited to Denial of Service\nand cannot be escalated to achieve code execution or memory disclosure.\n\nExploiting this issue requires an attacker to provide a malformed PKCS#12 file\nto an application that processes it. For that reason the issue was assessed as\nLow severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS#12 implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-69421"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:1473"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-69421"
},
{
"url": "https://bugzilla.redhat.com/2430375"
},
{
"url": "https://bugzilla.redhat.com/2430376"
},
{
"url": "https://bugzilla.redhat.com/2430377"
},
{
"url": "https://bugzilla.redhat.com/2430378"
},
{
"url": "https://bugzilla.redhat.com/2430379"
},
{
"url": "https://bugzilla.redhat.com/2430380"
},
{
"url": "https://bugzilla.redhat.com/2430381"
},
{
"url": "https://bugzilla.redhat.com/2430386"
},
{
"url": "https://bugzilla.redhat.com/2430387"
},
{
"url": "https://bugzilla.redhat.com/2430388"
},
{
"url": "https://bugzilla.redhat.com/2430389"
},
{
"url": "https://bugzilla.redhat.com/2430390"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430375"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430376"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430377"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430378"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430379"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430380"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430381"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430386"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430387"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430388"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430389"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430390"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11187"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15467"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15468"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15469"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66199"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68160"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69418"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69419"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69420"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69421"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22795"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22796"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-1473.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:1473"
},
{
"url": "https://github.com/advisories/GHSA-w9rv-xc8m-cmqp"
},
{
"url": "https://github.com/openssl/openssl/commit/3524a29271f8191b8fd8a5257eb05173982a097b"
},
{
"url": "https://github.com/openssl/openssl/commit/36ecb4960872a4ce04bf6f1e1f4e78d75ec0c0c7"
},
{
"url": "https://github.com/openssl/openssl/commit/4bbc8d41a72c842ce4077a8a3eccd1109aaf74bd"
},
{
"url": "https://github.com/openssl/openssl/commit/643986985cd1c21221f941129d76fe0c2785aeb3"
},
{
"url": "https://github.com/openssl/openssl/commit/a2dbc539f0f9cc63832709fa5aa33ad9495eb19c"
},
{
"url": "https://linux.oracle.com/cve/CVE-2025-69421.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2026-50081.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69421"
},
{
"url": "https://openssl-library.org/news/secadv/20260127.txt"
},
{
"url": "https://ubuntu.com/security/notices/USN-7980-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7980-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-69421"
}
],
"published": "2026-01-27T16:16:34+00:00",
"updated": "2026-05-12T13:17:26+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
}
},
{
"id": "CVE-2025-7039",
"ratings": [
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "low"
},
{
"source": {
"name": "redhat"
},
"score": 3.7,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
22
],
"description": "A flaw was found in glib. An integer overflow during temporary file creation leads to an out-of-bounds memory access, allowing an attacker to potentially perform path traversal or access private temporary file content by creating symbolic links. This vulnerability allows a local attacker to manipulate file paths and access unauthorized data. The core issue stems from insufficient validation of file path lengths during temporary file operations.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-7039"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-7039"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2392423"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
},
{
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3716"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7039"
},
{
"url": "https://ubuntu.com/security/notices/USN-7942-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7942-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-7039"
}
],
"published": "2025-09-03T02:15:38+00:00",
"updated": "2026-06-02T14:16:39+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.56.4-169.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-70873",
"ratings": [
{
"source": {
"name": "azure"
},
"severity": "high"
},
{
"source": {
"name": "bitnami"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 3.3,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
}
],
"cwes": [
244
],
"description": "An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-70873"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-70873"
},
{
"url": "https://gist.github.com/cnwangjihe/f496393f30f5ecec5b18c8f5ab072054"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-70873"
},
{
"url": "https://sqlite.org/forum/forumpost/761eac3c82"
},
{
"url": "https://sqlite.org/src/info/3d459f1fb1bd1b5e"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-70873"
}
],
"published": "2026-03-12T19:16:15+00:00",
"updated": "2026-04-16T21:15:47+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.26.0-20.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-8114",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 4.7,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 4.7,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "rocky"
},
"severity": "medium"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
476
],
"description": "A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID during the key exchange (KEX) process, an allocation failure in cryptographic functions may lead to a NULL pointer dereference. This issue can cause the client or server to crash.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-8114"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:18683"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-8114"
},
{
"url": "https://bugzilla.redhat.com/2369367"
},
{
"url": "https://bugzilla.redhat.com/2376184"
},
{
"url": "https://bugzilla.redhat.com/2376193"
},
{
"url": "https://bugzilla.redhat.com/2383220"
},
{
"url": "https://bugzilla.redhat.com/2383888"
},
{
"url": "https://bugzilla.redhat.com/2433121"
},
{
"url": "https://bugzilla.redhat.com/2436979"
},
{
"url": "https://bugzilla.redhat.com/2436980"
},
{
"url": "https://bugzilla.redhat.com/2436981"
},
{
"url": "https://bugzilla.redhat.com/2436982"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2369367"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2376184"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2376193"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2383220"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2383888"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433121"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436979"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436980"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436981"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436982"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4877"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4878"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5351"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8114"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8277"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0964"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0965"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0966"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0967"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0968"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-18683.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:18683"
},
{
"url": "https://git.libssh.org/projects/libssh.git/commit/?id=53ac23ded4cb2c5463f6c4cd1525331bd578812d"
},
{
"url": "https://git.libssh.org/projects/libssh.git/commit/?id=65f363c9"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8114"
},
{
"url": "https://ubuntu.com/security/notices/USN-7849-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-8114"
},
{
"url": "https://www.libssh.org/security/advisories/CVE-2025-8114.txt"
}
],
"published": "2025-07-24T15:15:27+00:00",
"updated": "2026-05-19T14:16:28+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "0.9.6-16.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "0.9.6-16.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-8277",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "low"
},
{
"source": {
"name": "redhat"
},
"score": 3.1,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "rocky"
},
"severity": "medium"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
401
],
"description": "A flaw was found in libssh's handling of key exchange (KEX) processes when a client repeatedly sends incorrect KEX guesses. The library fails to free memory during these rekey operations, which can gradually exhaust system memory. This issue can lead to crashes on the client side, particularly when using libgcrypt, which impacts application stability and availability.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-8277"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:18683"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-8277"
},
{
"url": "https://bugzilla.redhat.com/2369367"
},
{
"url": "https://bugzilla.redhat.com/2376184"
},
{
"url": "https://bugzilla.redhat.com/2376193"
},
{
"url": "https://bugzilla.redhat.com/2383220"
},
{
"url": "https://bugzilla.redhat.com/2383888"
},
{
"url": "https://bugzilla.redhat.com/2433121"
},
{
"url": "https://bugzilla.redhat.com/2436979"
},
{
"url": "https://bugzilla.redhat.com/2436980"
},
{
"url": "https://bugzilla.redhat.com/2436981"
},
{
"url": "https://bugzilla.redhat.com/2436982"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2369367"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2376184"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2376193"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2383220"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2383888"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433121"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436979"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436980"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436981"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436982"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4877"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4878"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5351"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8114"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8277"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0964"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0965"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0966"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0967"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0968"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-18683.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:18683"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8277"
},
{
"url": "https://ubuntu.com/security/notices/USN-8051-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8051-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-8277"
},
{
"url": "https://www.libssh.org/security/advisories/CVE-2025-8277.txt"
}
],
"published": "2025-09-09T12:15:30+00:00",
"updated": "2026-05-19T14:16:29+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "0.9.6-16.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "0.9.6-16.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-8291",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "bitnami"
},
"score": 4.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "medium"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 4.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
},
{
"source": {
"name": "rocky"
},
"severity": "medium"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
1285
],
"description": "The 'zipfile' module would not check the validity of the ZIP64 End of\nCentral Directory (EOCD) Locator record offset value would not be used to\nlocate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be\nassumed to be the previous record in the ZIP archive. This could be abused\nto create ZIP archives that are handled differently by the 'zipfile' module\ncompared to other ZIP implementations.\n\n\nRemediation maintains this behavior, but checks that the offset specified\nin the ZIP64 EOCD Locator record matches the expected value.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-8291"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:23342"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-8291"
},
{
"url": "https://bugzilla.redhat.com/2294682"
},
{
"url": "https://bugzilla.redhat.com/2373234"
},
{
"url": "https://bugzilla.redhat.com/2402342"
},
{
"url": "https://bugzilla.redhat.com/2408891"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2294682"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373234"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2402342"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2408891"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5642"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6069"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6075"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8291"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2025-23342.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2025:23342"
},
{
"url": "https://github.com/google/security-research/security/advisories/GHSA-hhv7-p4pg-wm6p"
},
{
"url": "https://github.com/psf/advisory-database/blob/main/advisories/python/PSF-2025-12.json"
},
{
"url": "https://github.com/python/cpython/commit/162997bb70e067668c039700141770687bc8f267"
},
{
"url": "https://github.com/python/cpython/commit/1d29afb0d6218aa8fb5e1e4a6133a4778d89bb46"
},
{
"url": "https://github.com/python/cpython/commit/333d4a6f4967d3ace91492a39ededbcf3faa76a6"
},
{
"url": "https://github.com/python/cpython/commit/76437ac248ad8ca44e9bf697b02b1e2241df2196"
},
{
"url": "https://github.com/python/cpython/commit/8392b2f0d35678407d9ce7d95655a5b77de161b4"
},
{
"url": "https://github.com/python/cpython/commit/bca11ae7d575d87ed93f5dd6a313be6246e3e388"
},
{
"url": "https://github.com/python/cpython/commit/d11e69d6203080e3ec450446bfed0516727b85c3"
},
{
"url": "https://github.com/python/cpython/issues/139700"
},
{
"url": "https://github.com/python/cpython/pull/139702"
},
{
"url": "https://linux.oracle.com/cve/CVE-2025-8291.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2026-0123.html"
},
{
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/QECOPWMTH4VPPJAXAH2BGTA4XADOP62G/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8291"
},
{
"url": "https://ubuntu.com/security/notices/USN-7886-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7886-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-8291"
}
],
"published": "2025-10-07T18:16:00+00:00",
"updated": "2026-04-15T00:35:42+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-76.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-76.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-0672",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 4.8,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
93
],
"description": "When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-0672"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:19177"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-0672"
},
{
"url": "https://bugzilla.redhat.com/2395108"
},
{
"url": "https://bugzilla.redhat.com/2408891"
},
{
"url": "https://bugzilla.redhat.com/2418084"
},
{
"url": "https://bugzilla.redhat.com/2431366"
},
{
"url": "https://bugzilla.redhat.com/2431374"
},
{
"url": "https://bugzilla.redhat.com/2444691"
},
{
"url": "https://bugzilla.redhat.com/2448168"
},
{
"url": "https://bugzilla.redhat.com/2448181"
},
{
"url": "https://bugzilla.redhat.com/2449649"
},
{
"url": "https://bugzilla.redhat.com/2457409"
},
{
"url": "https://bugzilla.redhat.com/2457932"
},
{
"url": "https://bugzilla.redhat.com/2458049"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2395108"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2408891"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418084"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431366"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431374"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444691"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448168"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448181"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449649"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457409"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457932"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458049"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13837"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15282"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59375"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6075"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0672"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1502"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2297"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3644"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4224"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4519"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4786"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6100"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-19177.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:19177"
},
{
"url": "https://github.com/python/cpython/commit/62700107418eb2cca3fc88da036a243ea975f172"
},
{
"url": "https://github.com/python/cpython/commit/712452e6f1d4b9f7f8c4c92ebfcaac1705faa440"
},
{
"url": "https://github.com/python/cpython/commit/7852d72b653fea0199acf5fc2a84f6f8b84eba8d"
},
{
"url": "https://github.com/python/cpython/commit/918387e4912d12ffc166c8f2a38df92b6ec756ca"
},
{
"url": "https://github.com/python/cpython/commit/95746b3a13a985787ef53b977129041971ed7f70"
},
{
"url": "https://github.com/python/cpython/commit/b1869ff648bbee0717221d09e6deff46617f3e85"
},
{
"url": "https://github.com/python/cpython/issues/143919"
},
{
"url": "https://github.com/python/cpython/pull/143920"
},
{
"url": "https://linux.oracle.com/cve/CVE-2026-0672.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2026-10950.html"
},
{
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/6VFLQQEIX673KXKFUZXCUNE5AZOGZ45M/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0672"
},
{
"url": "https://ubuntu.com/security/notices/USN-8018-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8018-3"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0672"
}
],
"published": "2026-01-20T22:15:52+00:00",
"updated": "2026-04-15T00:35:42+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-76.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-76.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-0964",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 6.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
},
{
"source": {
"name": "redhat"
},
"score": 5,
"severity": "medium",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L"
},
{
"source": {
"name": "rocky"
},
"severity": "medium"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
22
],
"description": "A malicious SCP server can send unexpected paths that could make the\nclient application override local files outside of working directory.\nThis could be misused to create malicious executable or configuration\nfiles and make the user execute them under specific consequences.\n\nThis is the same issue as in OpenSSH, tracked as CVE-2019-6111.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-0964"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:18160"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:18683"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-0964"
},
{
"url": "https://bugzilla.redhat.com/2369367"
},
{
"url": "https://bugzilla.redhat.com/2376184"
},
{
"url": "https://bugzilla.redhat.com/2376193"
},
{
"url": "https://bugzilla.redhat.com/2383220"
},
{
"url": "https://bugzilla.redhat.com/2383888"
},
{
"url": "https://bugzilla.redhat.com/2433121"
},
{
"url": "https://bugzilla.redhat.com/2436979"
},
{
"url": "https://bugzilla.redhat.com/2436980"
},
{
"url": "https://bugzilla.redhat.com/2436981"
},
{
"url": "https://bugzilla.redhat.com/2436982"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2369367"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2376184"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2376193"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2383220"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2383888"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433121"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436979"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436980"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436981"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436982"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4877"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4878"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5351"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8114"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8277"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0964"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0965"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0966"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0967"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0968"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-18683.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:18683"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0964"
},
{
"url": "https://ubuntu.com/security/notices/USN-8051-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8051-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0964"
},
{
"url": "https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/"
},
{
"url": "https://www.libssh.org/security/advisories/CVE-2026-0964.txt"
}
],
"published": "2026-03-26T21:17:00+00:00",
"updated": "2026-05-19T14:16:32+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "0.9.6-16.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "0.9.6-16.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-0965",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "redhat"
},
"score": 3.3,
"severity": "low",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "rocky"
},
"severity": "medium"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
73
],
"description": "A flaw was found in libssh where it can attempt to open arbitrary files during configuration parsing. A local attacker can exploit this by providing a malicious configuration file or when the system is misconfigured. This vulnerability could lead to a Denial of Service (DoS) by causing the system to try and access dangerous files, such as block devices or large system files, which can disrupt normal operations.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-0965"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:18160"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:18683"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-0965"
},
{
"url": "https://bugzilla.redhat.com/2369367"
},
{
"url": "https://bugzilla.redhat.com/2376184"
},
{
"url": "https://bugzilla.redhat.com/2376193"
},
{
"url": "https://bugzilla.redhat.com/2383220"
},
{
"url": "https://bugzilla.redhat.com/2383888"
},
{
"url": "https://bugzilla.redhat.com/2433121"
},
{
"url": "https://bugzilla.redhat.com/2436979"
},
{
"url": "https://bugzilla.redhat.com/2436980"
},
{
"url": "https://bugzilla.redhat.com/2436981"
},
{
"url": "https://bugzilla.redhat.com/2436982"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2369367"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2376184"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2376193"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2383220"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2383888"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433121"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436979"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436980"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436981"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436982"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4877"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4878"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5351"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8114"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8277"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0964"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0965"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0966"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0967"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0968"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-18683.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:18683"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0965"
},
{
"url": "https://ubuntu.com/security/notices/USN-8051-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8051-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0965"
},
{
"url": "https://www.libssh.org/security/advisories/CVE-2026-0965.txt"
}
],
"published": "2026-03-26T21:17:00+00:00",
"updated": "2026-05-19T14:16:33+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "0.9.6-16.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "0.9.6-16.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-0966",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 8.2,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"
},
{
"source": {
"name": "rocky"
},
"severity": "medium"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
124
],
"description": "A flaw was found in libssh. The API function `ssh_get_hexa()` is vulnerable to a denial of service when processing zero-length input. This can be exploited remotely by an attacker during GSSAPI (Generic Security Service Application Program Interface) authentication if the server's logging verbosity is set to `SSH_LOG_PACKET (3)` or higher. Successful exploitation could lead to a self-Denial of Service of the per-connection daemon process.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-0966"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:18160"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:18683"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:7067"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-0966"
},
{
"url": "https://bugzilla.redhat.com/2369367"
},
{
"url": "https://bugzilla.redhat.com/2376184"
},
{
"url": "https://bugzilla.redhat.com/2376193"
},
{
"url": "https://bugzilla.redhat.com/2383220"
},
{
"url": "https://bugzilla.redhat.com/2383888"
},
{
"url": "https://bugzilla.redhat.com/2433121"
},
{
"url": "https://bugzilla.redhat.com/2436979"
},
{
"url": "https://bugzilla.redhat.com/2436980"
},
{
"url": "https://bugzilla.redhat.com/2436981"
},
{
"url": "https://bugzilla.redhat.com/2436982"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2369367"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2376184"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2376193"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2383220"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2383888"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433121"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436979"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436980"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436981"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436982"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4877"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4878"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5351"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8114"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8277"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0964"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0965"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0966"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0967"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0968"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-18683.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:18683"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0966"
},
{
"url": "https://ubuntu.com/security/notices/USN-8051-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8051-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0966"
},
{
"url": "https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/"
},
{
"url": "https://www.libssh.org/security/advisories/CVE-2026-0966.txt"
}
],
"published": "2026-03-26T21:17:00+00:00",
"updated": "2026-05-19T14:16:36+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "0.9.6-16.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "0.9.6-16.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-0967",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "nvd"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 2.2,
"severity": "low",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "rocky"
},
"severity": "medium"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
1333
],
"description": "A flaw was found in libssh. A remote attacker, by controlling client configuration files or known_hosts files, could craft specific hostnames that when processed by the `match_pattern()` function can lead to inefficient regular expression backtracking. This can cause timeouts and resource exhaustion, resulting in a Denial of Service (DoS) for the client.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-0967"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:18160"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:18683"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-0967"
},
{
"url": "https://bugzilla.redhat.com/2369367"
},
{
"url": "https://bugzilla.redhat.com/2376184"
},
{
"url": "https://bugzilla.redhat.com/2376193"
},
{
"url": "https://bugzilla.redhat.com/2383220"
},
{
"url": "https://bugzilla.redhat.com/2383888"
},
{
"url": "https://bugzilla.redhat.com/2433121"
},
{
"url": "https://bugzilla.redhat.com/2436979"
},
{
"url": "https://bugzilla.redhat.com/2436980"
},
{
"url": "https://bugzilla.redhat.com/2436981"
},
{
"url": "https://bugzilla.redhat.com/2436982"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2369367"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2376184"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2376193"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2383220"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2383888"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433121"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436979"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436980"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436981"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436982"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4877"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4878"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5351"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8114"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8277"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0964"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0965"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0966"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0967"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0968"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-18683.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:18683"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0967"
},
{
"url": "https://ubuntu.com/security/notices/USN-8051-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8051-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0967"
},
{
"url": "https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/"
},
{
"url": "https://www.libssh.org/security/advisories/CVE-2026-0967.txt"
}
],
"published": "2026-03-26T21:17:00+00:00",
"updated": "2026-05-19T14:16:36+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "0.9.6-16.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "0.9.6-16.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-0968",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "nvd"
},
"score": 3.1,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "redhat"
},
"score": 3.1,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "rocky"
},
"severity": "medium"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
476
],
"description": "A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an `SSH_FXP_NAME` message during a file listing operation. This missing null check can lead to reading beyond allocated memory on the heap. This can cause unexpected behavior or lead to a denial of service (DoS) due to application crashes.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-0968"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:18160"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:18683"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-0968"
},
{
"url": "https://bugzilla.redhat.com/2369367"
},
{
"url": "https://bugzilla.redhat.com/2376184"
},
{
"url": "https://bugzilla.redhat.com/2376193"
},
{
"url": "https://bugzilla.redhat.com/2383220"
},
{
"url": "https://bugzilla.redhat.com/2383888"
},
{
"url": "https://bugzilla.redhat.com/2433121"
},
{
"url": "https://bugzilla.redhat.com/2436979"
},
{
"url": "https://bugzilla.redhat.com/2436980"
},
{
"url": "https://bugzilla.redhat.com/2436981"
},
{
"url": "https://bugzilla.redhat.com/2436982"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2369367"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2376184"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2376193"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2383220"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2383888"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433121"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436979"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436980"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436981"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436982"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4877"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4878"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5351"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8114"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8277"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0964"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0965"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0966"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0967"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0968"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-18683.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:18683"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0968"
},
{
"url": "https://ubuntu.com/security/notices/USN-8051-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8051-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0968"
},
{
"url": "https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/"
},
{
"url": "https://www.libssh.org/security/advisories/CVE-2026-0968.txt"
}
],
"published": "2026-03-26T21:17:01+00:00",
"updated": "2026-05-19T14:16:38+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "0.9.6-16.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "0.9.6-16.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-0988",
"ratings": [
{
"source": {
"name": "cbl-mariner"
},
"severity": "low"
},
{
"source": {
"name": "redhat"
},
"score": 3.7,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
190
],
"description": "A flaw was found in glib. Missing validation of offset and count parameters in the g_buffered_input_stream_peek() function can lead to an integer overflow during length calculation. When specially crafted values are provided, this overflow results in an incorrect size being passed to memcpy(), triggering a buffer overflow. This can cause application crashes, leading to a Denial of Service (DoS).",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-0988"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:7461"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-0988"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2429886"
},
{
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3851"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0988"
},
{
"url": "https://ubuntu.com/security/notices/USN-7971-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0988"
}
],
"published": "2026-01-21T12:15:55+00:00",
"updated": "2026-04-24T21:16:17+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.56.4-169.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-0989",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "low"
},
{
"source": {
"name": "redhat"
},
"score": 3.7,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
674
],
"description": "A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may lead to stack exhaustion and application crashes, creating a denial-of-service risk.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-0989"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:7519"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-0989"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2429933"
},
{
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/998"
},
{
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/merge_requests/374"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0989"
},
{
"url": "https://ubuntu.com/security/notices/USN-7974-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0989"
}
],
"published": "2026-01-15T15:15:52+00:00",
"updated": "2026-04-22T10:16:49+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.9.7-21.el8_10.4",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-0990",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.9,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
674
],
"description": "A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that references itself. A remote attacker could exploit this configuration-dependent issue by providing a specially crafted XML catalog, leading to infinite recursion and call stack exhaustion. This ultimately results in a segmentation fault, causing a Denial of Service (DoS) by crashing affected applications.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-0990"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:7519"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-0990"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2429959"
},
{
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/1018"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0990"
},
{
"url": "https://ubuntu.com/security/notices/USN-7974-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0990"
}
],
"published": "2026-01-15T15:15:52+00:00",
"updated": "2026-04-22T10:16:50+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.9.7-21.el8_10.4",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-0992",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "low"
},
{
"source": {
"name": "redhat"
},
"score": 2.9,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
400
],
"description": "A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-0992"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:7519"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-0992"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2429975"
},
{
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/1019"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0992"
},
{
"url": "https://ubuntu.com/security/notices/USN-7974-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0992"
}
],
"published": "2026-01-15T15:15:52+00:00",
"updated": "2026-04-22T10:16:50+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.9.7-21.el8_10.4",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-11850",
"ratings": [
{
"source": {
"name": "redhat"
},
"score": 5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H"
}
],
"cwes": [
191
],
"description": "An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read.\nThe attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-11850"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:25520"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-11850"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2459970"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11850"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-11850"
}
],
"published": "2026-06-11T10:16:21+00:00",
"updated": "2026-06-12T15:16:24+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/krb5-libs@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.18.2-34.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/krb5-workstation@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.18.2-34.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libkadm5@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.18.2-34.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/krb5-libs@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/krb5-libs@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/krb5-libs@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/krb5-workstation@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libkadm5@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/krb5-libs@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/krb5-workstation@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libkadm5@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/krb5-libs@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/krb5-workstation@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libkadm5@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/krb5-libs@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/krb5-workstation@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libkadm5@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/krb5-libs@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/krb5-workstation@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libkadm5@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/krb5-libs@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/krb5-workstation@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libkadm5@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/krb5-libs@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/krb5-workstation@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libkadm5@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/krb5-libs@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/krb5-workstation@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libkadm5@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/krb5-libs@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/krb5-workstation@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libkadm5@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/krb5-libs@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/krb5-workstation@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libkadm5@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/krb5-libs@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/krb5-workstation@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libkadm5@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/krb5-libs@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/krb5-workstation@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libkadm5@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/krb5-libs@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/krb5-workstation@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libkadm5@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/krb5-libs@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/krb5-workstation@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libkadm5@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/krb5-libs@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/krb5-workstation@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libkadm5@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/krb5-libs@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/krb5-workstation@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libkadm5@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/krb5-libs@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/krb5-workstation@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libkadm5@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/krb5-libs@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/krb5-workstation@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libkadm5@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/krb5-libs@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/krb5-workstation@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libkadm5@1.18.2-34.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-1484",
"ratings": [
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 4.2,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
787
],
"description": "A flaw was found in the GLib Base64 encoding routine when processing very large input data. Due to incorrect use of integer types during length calculation, the library may miscalculate buffer boundaries. This can cause memory writes outside the allocated buffer. Applications that process untrusted or extremely large Base64 input using GLib may crash or behave unpredictably.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-1484"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-1484"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433259"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
},
{
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3870"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1484"
},
{
"url": "https://ubuntu.com/security/notices/USN-8017-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1484"
}
],
"published": "2026-01-27T14:15:56+00:00",
"updated": "2026-06-02T14:16:45+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.56.4-169.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-1485",
"ratings": [
{
"source": {
"name": "photon"
},
"severity": "low"
},
{
"source": {
"name": "redhat"
},
"score": 2.8,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
124
],
"description": "A flaw was found in Glib's content type parsing logic. This buffer underflow vulnerability occurs because the length of a header line is stored in a signed integer, which can lead to integer wraparound for very large inputs. This results in pointer underflow and out-of-bounds memory access. Exploitation requires a local user to install or process a specially crafted treemagic file, which can lead to local denial of service or application instability.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-1485"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-1485"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433325"
},
{
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3871"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1485"
},
{
"url": "https://ubuntu.com/security/notices/USN-8017-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1485"
}
],
"published": "2026-01-27T14:15:56+00:00",
"updated": "2026-04-15T00:35:42+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.56.4-169.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-1489",
"ratings": [
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.4,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
787
],
"description": "A flaw was found in GLib. An integer overflow vulnerability in its Unicode case conversion implementation can lead to memory corruption. By processing specially crafted and extremely large Unicode strings, an attacker could trigger an undersized memory allocation, resulting in out-of-bounds writes. This could cause applications utilizing GLib for string conversion to crash or become unstable.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-1489"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-1489"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433348"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
},
{
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3872"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1489"
},
{
"url": "https://ubuntu.com/security/notices/USN-8017-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1489"
}
],
"published": "2026-01-27T15:15:57+00:00",
"updated": "2026-06-02T14:16:45+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.56.4-169.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/glib2@2.56.4-169.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-1502",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 4.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
}
],
"cwes": [
93
],
"description": "CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-1502"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/04/11/4"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:19177"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-1502"
},
{
"url": "https://bugzilla.redhat.com/2395108"
},
{
"url": "https://bugzilla.redhat.com/2408891"
},
{
"url": "https://bugzilla.redhat.com/2418084"
},
{
"url": "https://bugzilla.redhat.com/2431366"
},
{
"url": "https://bugzilla.redhat.com/2431374"
},
{
"url": "https://bugzilla.redhat.com/2444691"
},
{
"url": "https://bugzilla.redhat.com/2448168"
},
{
"url": "https://bugzilla.redhat.com/2448181"
},
{
"url": "https://bugzilla.redhat.com/2449649"
},
{
"url": "https://bugzilla.redhat.com/2457409"
},
{
"url": "https://bugzilla.redhat.com/2457932"
},
{
"url": "https://bugzilla.redhat.com/2458049"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2395108"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2408891"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418084"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431366"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431374"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444691"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448168"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448181"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449649"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457409"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457932"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458049"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13837"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15282"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59375"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6075"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0672"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1502"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2297"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3644"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4224"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4519"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4786"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6100"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-19177.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:19177"
},
{
"url": "https://github.com/python/cpython/commit/05ed7ce7ae9e17c23a04085b2539fe6d6d3cef69"
},
{
"url": "https://github.com/python/cpython/commit/9e071c9b28c17f347f81b388a003d4eeb3c7a8dd"
},
{
"url": "https://github.com/python/cpython/commit/b1cf9016335cb637c5a425032e8274a224f4b2ed"
},
{
"url": "https://github.com/python/cpython/commit/c00c386faa579ad71196d33408644478488e43ec"
},
{
"url": "https://github.com/python/cpython/issues/146211"
},
{
"url": "https://github.com/python/cpython/pull/146212"
},
{
"url": "https://linux.oracle.com/cve/CVE-2026-1502.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2026-10950.html"
},
{
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/2IVPAEQWUJBCTQZEJEVTYCIKSMQPGRZ3/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1502"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1502"
}
],
"published": "2026-04-10T18:16:40+00:00",
"updated": "2026-06-04T15:16:50+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-76.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-76.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-1757",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "low"
},
{
"source": {
"name": "redhat"
},
"score": 6.2,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
401
],
"description": "A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocated for user input is not properly released under certain conditions. When a user submits input consisting only of whitespace, the program skips command execution but fails to free the allocated buffer. Repeating this action causes memory to continuously accumulate. Over time, this can exhaust system memory and terminate the xmllint process, creating a denial-of-service condition on the local system.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-1757"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:7519"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-1757"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2435940"
},
{
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/1009"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1757"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1757"
}
],
"published": "2026-02-02T13:15:58+00:00",
"updated": "2026-04-22T10:16:50+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.9.7-21.el8_10.4",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-1965",
"ratings": [
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "julia"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 6.8,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
305
],
"description": "libcurl can in some circumstances reuse the wrong connection when asked to do\nan Negotiate-authenticated HTTP or HTTPS request.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criterion must first be met. Due to a\nlogical error in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials. One underlying reason being that\nNegotiate sometimes authenticates *connections* and not *requests*, contrary\nto how HTTP is designed to work.\n\nAn application that allows Negotiate authentication to a server (that responds\nwanting Negotiate) with `user1:password1` and then does another operation to\nthe same server also using Negotiate but with `user2:password2` (while the\nprevious connection is still alive) - the second request wrongly reused the\nsame connection and since it then sees that the Negotiate negotiation is\nalready made, it just sends the request over that connection thinking it uses\nthe user2 credentials when it is in fact still using the connection\nauthenticated for user1...\n\nThe set of authentication methods to use is set with `CURLOPT_HTTPAUTH`.\n\nApplications can disable libcurl's reuse of connections and thus mitigate this\nproblem, by using one of the following libcurl options to alter how\nconnections are or are not reused: `CURLOPT_FRESH_CONNECT`,\n`CURLOPT_MAXCONNECTS` and `CURLMOPT_MAX_HOST_CONNECTIONS` (if using the\ncurl_multi API).",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-1965"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-1965"
},
{
"url": "https://curl.se/docs/CVE-2026-1965.html"
},
{
"url": "https://curl.se/docs/CVE-2026-1965.json"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1965"
},
{
"url": "https://ubuntu.com/security/notices/USN-8084-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8099-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1965"
}
],
"published": "2026-03-11T11:15:59+00:00",
"updated": "2026-03-12T14:11:19+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.11",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.11",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-22185",
"ratings": [
{
"source": {
"name": "redhat"
},
"score": 6.8,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
125,
191
],
"description": "OpenLDAP Lightning Memory-Mapped Database (LMDB) versions up to and including 0.9.14, prior to commit 8e1fda8, contain a heap buffer underflow in the readline() function of mdb_load. When processing malformed input containing an embedded NUL byte, an unsigned offset calculation can underflow and cause an out-of-bounds read of one byte before the allocated heap buffer. This can cause mdb_load to crash, leading to a limited denial-of-service condition.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-22185"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-22185"
},
{
"url": "https://bugs.openldap.org/show_bug.cgi?id=10421"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22185"
},
{
"url": "https://seclists.org/fulldisclosure/2026/Jan/5"
},
{
"url": "https://seclists.org/fulldisclosure/2026/Jan/8"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22185"
},
{
"url": "https://www.openldap.org/"
},
{
"url": "https://www.vulncheck.com/advisories/openldap-lmdb-mdb-load-heap-buffer-underflow-in-readline"
}
],
"published": "2026-01-07T21:16:01+00:00",
"updated": "2026-04-15T00:35:42+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.4.46-21.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-22795",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "julia"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
754
],
"description": "Issue summary: An invalid or NULL pointer dereference can happen in\nan application processing a malformed PKCS#12 file.\n\nImpact summary: An application processing a malformed PKCS#12 file can be\ncaused to dereference an invalid or NULL pointer on memory read, resulting\nin a Denial of Service.\n\nA type confusion vulnerability exists in PKCS#12 parsing code where\nan ASN1_TYPE union member is accessed without first validating the type,\ncausing an invalid pointer read.\n\nThe location is constrained to a 1-byte address space, meaning any\nattempted pointer manipulation can only target addresses between 0x00 and 0xFF.\nThis range corresponds to the zero page, which is unmapped on most modern\noperating systems and will reliably result in a crash, leading only to a\nDenial of Service. Exploiting this issue also requires a user or application\nto process a maliciously crafted PKCS#12 file. It is uncommon to accept\nuntrusted PKCS#12 files in applications as they are usually used to store\nprivate keys which are trusted by definition. For these reasons, the issue\nwas assessed as Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS12 implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.\n\nOpenSSL 1.0.2 is not affected by this issue.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-22795"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:1473"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-22795"
},
{
"url": "https://bugzilla.redhat.com/2430375"
},
{
"url": "https://bugzilla.redhat.com/2430376"
},
{
"url": "https://bugzilla.redhat.com/2430377"
},
{
"url": "https://bugzilla.redhat.com/2430378"
},
{
"url": "https://bugzilla.redhat.com/2430379"
},
{
"url": "https://bugzilla.redhat.com/2430380"
},
{
"url": "https://bugzilla.redhat.com/2430381"
},
{
"url": "https://bugzilla.redhat.com/2430386"
},
{
"url": "https://bugzilla.redhat.com/2430387"
},
{
"url": "https://bugzilla.redhat.com/2430388"
},
{
"url": "https://bugzilla.redhat.com/2430389"
},
{
"url": "https://bugzilla.redhat.com/2430390"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430375"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430376"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430377"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430378"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430379"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430380"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430381"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430386"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430387"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430388"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430389"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430390"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11187"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15467"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15468"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15469"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66199"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68160"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69418"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69419"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69420"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69421"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22795"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22796"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-1473.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:1473"
},
{
"url": "https://github.com/advisories/GHSA-3vqq-45qg-2xf6"
},
{
"url": "https://github.com/openssl/openssl/commit/2502e7b7d4c0cf4f972a881641fe09edc67aeec4"
},
{
"url": "https://github.com/openssl/openssl/commit/572844beca95068394c916626a6d3a490f831a49"
},
{
"url": "https://github.com/openssl/openssl/commit/7bbca05be55b129651d9df4bdb92becc45002c12"
},
{
"url": "https://github.com/openssl/openssl/commit/eeee3cbd4d682095ed431052f00403004596373e"
},
{
"url": "https://github.com/openssl/openssl/commit/ef2fb66ec571564d64d1c74a12e388a2a54d05d2"
},
{
"url": "https://linux.oracle.com/cve/CVE-2026-22795.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2026-50081.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22795"
},
{
"url": "https://openssl-library.org/news/secadv/20260127.txt"
},
{
"url": "https://ubuntu.com/security/notices/USN-7980-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7980-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22795"
}
],
"published": "2026-01-27T16:16:35+00:00",
"updated": "2026-05-12T13:17:32+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
}
},
{
"id": "CVE-2026-22796",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "julia"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.9,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
754
],
"description": "Issue summary: A type confusion vulnerability exists in the signature\nverification of signed PKCS#7 data where an ASN1_TYPE union member is\naccessed without first validating the type, causing an invalid or NULL\npointer dereference when processing malformed PKCS#7 data.\n\nImpact summary: An application performing signature verification of PKCS#7\ndata or calling directly the PKCS7_digest_from_attributes() function can be\ncaused to dereference an invalid or NULL pointer when reading, resulting in\na Denial of Service.\n\nThe function PKCS7_digest_from_attributes() accesses the message digest attribute\nvalue without validating its type. When the type is not V_ASN1_OCTET_STRING,\nthis results in accessing invalid memory through the ASN1_TYPE union, causing\na crash.\n\nExploiting this vulnerability requires an attacker to provide a malformed\nsigned PKCS#7 to an application that verifies it. The impact of the\nexploit is just a Denial of Service, the PKCS7 API is legacy and applications\nshould be using the CMS API instead. For these reasons the issue was\nassessed as Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS#7 parsing implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-22796"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:1473"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-22796"
},
{
"url": "https://bugzilla.redhat.com/2430375"
},
{
"url": "https://bugzilla.redhat.com/2430376"
},
{
"url": "https://bugzilla.redhat.com/2430377"
},
{
"url": "https://bugzilla.redhat.com/2430378"
},
{
"url": "https://bugzilla.redhat.com/2430379"
},
{
"url": "https://bugzilla.redhat.com/2430380"
},
{
"url": "https://bugzilla.redhat.com/2430381"
},
{
"url": "https://bugzilla.redhat.com/2430386"
},
{
"url": "https://bugzilla.redhat.com/2430387"
},
{
"url": "https://bugzilla.redhat.com/2430388"
},
{
"url": "https://bugzilla.redhat.com/2430389"
},
{
"url": "https://bugzilla.redhat.com/2430390"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430375"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430376"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430377"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430378"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430379"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430380"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430381"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430386"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430387"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430388"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430389"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430390"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11187"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15467"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15468"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15469"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66199"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68160"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69418"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69419"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69420"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69421"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22795"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22796"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-1473.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:1473"
},
{
"url": "https://github.com/advisories/GHSA-r9hf-rxjm-gv2f"
},
{
"url": "https://github.com/openssl/openssl/commit/2502e7b7d4c0cf4f972a881641fe09edc67aeec4"
},
{
"url": "https://github.com/openssl/openssl/commit/572844beca95068394c916626a6d3a490f831a49"
},
{
"url": "https://github.com/openssl/openssl/commit/7bbca05be55b129651d9df4bdb92becc45002c12"
},
{
"url": "https://github.com/openssl/openssl/commit/eeee3cbd4d682095ed431052f00403004596373e"
},
{
"url": "https://github.com/openssl/openssl/commit/ef2fb66ec571564d64d1c74a12e388a2a54d05d2"
},
{
"url": "https://linux.oracle.com/cve/CVE-2026-22796.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2026-50081.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22796"
},
{
"url": "https://openssl-library.org/news/secadv/20260127.txt"
},
{
"url": "https://ubuntu.com/security/notices/USN-7980-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7980-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22796"
}
],
"published": "2026-01-27T16:16:35+00:00",
"updated": "2026-05-12T13:17:32+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
}
},
{
"id": "CVE-2026-2297",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 3.3,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
668
],
"description": "The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers for this audit event therefore do not fire.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-2297"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/03/05/6"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:19177"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-2297"
},
{
"url": "https://bugzilla.redhat.com/2395108"
},
{
"url": "https://bugzilla.redhat.com/2408891"
},
{
"url": "https://bugzilla.redhat.com/2418084"
},
{
"url": "https://bugzilla.redhat.com/2431366"
},
{
"url": "https://bugzilla.redhat.com/2431374"
},
{
"url": "https://bugzilla.redhat.com/2444691"
},
{
"url": "https://bugzilla.redhat.com/2448168"
},
{
"url": "https://bugzilla.redhat.com/2448181"
},
{
"url": "https://bugzilla.redhat.com/2449649"
},
{
"url": "https://bugzilla.redhat.com/2457409"
},
{
"url": "https://bugzilla.redhat.com/2457932"
},
{
"url": "https://bugzilla.redhat.com/2458049"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2395108"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2408891"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418084"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431366"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431374"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444691"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448168"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448181"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449649"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457409"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457932"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458049"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13837"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15282"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59375"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6075"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0672"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1502"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2297"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3644"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4224"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4519"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4786"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6100"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-19177.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:19177"
},
{
"url": "https://github.com/python/cpython/commit/482d6f8bdba9da3725d272e8bb4a2d25fb6a603e"
},
{
"url": "https://github.com/python/cpython/commit/69ddd9bb2cc4bd69b1565647c18659c6a789ccd9"
},
{
"url": "https://github.com/python/cpython/commit/876858c9f65d9ab656c7fa639f268ce7856d89dd"
},
{
"url": "https://github.com/python/cpython/commit/a51b1b512de1d56b3714b65628a2eae2b07e535e"
},
{
"url": "https://github.com/python/cpython/commit/e58e9802b9bec5cdbf48fc9bf1da5f4fda482e86"
},
{
"url": "https://github.com/python/cpython/issues/145506"
},
{
"url": "https://github.com/python/cpython/pull/145507"
},
{
"url": "https://linux.oracle.com/cve/CVE-2026-2297.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2026-10950.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2297"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2297"
}
],
"published": "2026-03-04T23:16:10+00:00",
"updated": "2026-05-01T16:16:30+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-76.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-76.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-24515",
"ratings": [
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "low"
},
{
"source": {
"name": "nvd"
},
"score": 2.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "photon"
},
"severity": "low"
},
{
"source": {
"name": "redhat"
},
"score": 2.9,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
476
],
"description": "In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-24515"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-24515"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
},
{
"url": "https://github.com/libexpat/libexpat/pull/1131"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24515"
},
{
"url": "https://ubuntu.com/security/notices/USN-8022-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8022-2"
},
{
"url": "https://ubuntu.com/security/notices/USN-8023-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24515"
}
],
"published": "2026-01-23T08:16:01+00:00",
"updated": "2026-06-02T14:16:49+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.5.0-2.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-24883",
"ratings": [
{
"source": {
"name": "julia"
},
"score": 3.7,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "nvd"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 3.7,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
}
],
"cwes": [
476
],
"description": "In GnuPG before 2.5.17, a long signature packet length causes parse_signature to return success with sig->data[] set to a NULL value, leading to a denial of service (application crash).",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-24883"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-24883"
},
{
"url": "https://dev.gnupg.org/T8049"
},
{
"url": "https://github.com/advisories/GHSA-7246-cvp4-g68w"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24883"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24883"
},
{
"url": "https://www.openwall.com/lists/oss-security/2026/01/27/8"
}
],
"published": "2026-01-27T19:16:16+00:00",
"updated": "2026-02-06T18:06:07+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.2.20-4.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-25645",
"ratings": [
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "ghsa"
},
"score": 4.4,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N"
},
{
"source": {
"name": "nvd"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 4.7,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N"
}
],
"cwes": [
377
],
"description": "Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.",
"recommendation": "; Upgrade requests to version 2.33.0",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-25645"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-25645"
},
{
"url": "https://github.com/psf/requests"
},
{
"url": "https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7"
},
{
"url": "https://github.com/psf/requests/releases/tag/v2.33.0"
},
{
"url": "https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25645"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25645"
}
],
"published": "2026-03-25T17:16:52+00:00",
"updated": "2026-03-30T14:23:16+00:00",
"affects": [
{
"ref": "pkg:pypi/requests@2.32.5",
"versions": [
{
"version": "2.32.5",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "9.0.3-24.el8",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "9.0.3-24.el8",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:pypi/requests@2.32.5"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:pypi/requests@2.32.5"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:pypi/requests@2.32.5"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:pypi/requests@2.32.5"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:pypi/requests@2.32.5"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:pypi/requests@2.32.5"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:pypi/requests@2.32.5"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:pypi/requests@2.32.5"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:pypi/requests@2.32.5"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:pypi/requests@2.32.5"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:pypi/requests@2.32.5"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:pypi/requests@2.32.5"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:pypi/requests@2.32.5"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:pypi/requests@2.32.5"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:pypi/requests@2.32.5"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:pypi/requests@2.32.5"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:pypi/requests@2.32.5"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:pypi/requests@2.32.5"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:pypi/requests@2.32.5"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
}
},
{
"id": "CVE-2026-27171",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "low"
},
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "low"
},
{
"source": {
"name": "julia"
},
"score": 2.9,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "nvd"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 3.3,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
1284
],
"description": "zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-27171"
},
{
"url": "https://7asecurity.com/blog/2026/02/zlib-7asecurity-audit"
},
{
"url": "https://7asecurity.com/blog/2026/02/zlib-7asecurity-audit/"
},
{
"url": "https://7asecurity.com/reports/pentest-report-zlib-RC1.1.pdf"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-27171"
},
{
"url": "https://github.com/advisories/GHSA-h858-mf2m-8jf4"
},
{
"url": "https://github.com/madler/zlib/issues/904"
},
{
"url": "https://github.com/madler/zlib/releases/tag/v1.3.2"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27171"
},
{
"url": "https://ostif.org/zlib-audit-complete"
},
{
"url": "https://ostif.org/zlib-audit-complete/"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27171"
}
],
"published": "2026-02-18T04:16:01+00:00",
"updated": "2026-03-25T21:27:04+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.2.11-25.el8",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-27456",
"ratings": [
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "julia"
},
"score": 4.7,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "redhat"
},
"score": 4.7,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
59,
269,
367
],
"description": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-27456"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-27456"
},
{
"url": "https://github.com/util-linux/util-linux/commit/5e390467b26a3cf3fecc04e1a0d482dff3162fc4"
},
{
"url": "https://github.com/util-linux/util-linux/releases/tag/v2.41.4"
},
{
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-qq4x-vfq4-9h9g"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27456"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27456"
}
],
"published": "2026-04-03T22:16:25+00:00",
"updated": "2026-04-22T16:08:55+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libblkid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.32.1-48.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libfdisk@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.32.1-48.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libmount@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.32.1-48.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libsmartcols@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.32.1-48.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libuuid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.32.1-48.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/util-linux@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.32.1-48.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libblkid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libfdisk@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libmount@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libsmartcols@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libuuid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/util-linux@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libblkid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libfdisk@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libmount@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libsmartcols@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libuuid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/util-linux@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libblkid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libfdisk@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libmount@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libsmartcols@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libuuid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/util-linux@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libblkid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libfdisk@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libmount@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libsmartcols@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libuuid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/util-linux@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libblkid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libfdisk@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libmount@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libsmartcols@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libuuid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/util-linux@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libblkid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libfdisk@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libmount@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libsmartcols@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libuuid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/util-linux@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libblkid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libfdisk@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libmount@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libsmartcols@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libuuid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/util-linux@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libblkid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libfdisk@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libmount@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libsmartcols@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libuuid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/util-linux@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libblkid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libfdisk@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libmount@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libsmartcols@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libuuid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/util-linux@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libblkid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libfdisk@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libmount@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libsmartcols@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libuuid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/util-linux@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libblkid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libfdisk@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libmount@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libsmartcols@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libuuid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/util-linux@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libblkid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libfdisk@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libmount@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libsmartcols@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libuuid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/util-linux@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libblkid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libfdisk@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libmount@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libsmartcols@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libuuid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/util-linux@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libblkid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libfdisk@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libmount@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libsmartcols@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libuuid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/util-linux@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libblkid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libfdisk@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libmount@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libsmartcols@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libuuid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/util-linux@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libblkid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libfdisk@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libmount@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libsmartcols@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libuuid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/util-linux@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libblkid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libfdisk@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libmount@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libsmartcols@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libuuid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/util-linux@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libblkid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libfdisk@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libmount@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libsmartcols@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libuuid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/util-linux@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libblkid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libfdisk@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libmount@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libsmartcols@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libuuid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/util-linux@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libblkid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libfdisk@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libmount@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libsmartcols@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libuuid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/util-linux@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libblkid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libfdisk@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libmount@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libsmartcols@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libuuid@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/util-linux@2.32.1-48.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-28387",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "nvd"
},
"score": 8.1,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 3.7,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
416
],
"description": "Issue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-28387"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-28387"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
},
{
"url": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b"
},
{
"url": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe"
},
{
"url": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3"
},
{
"url": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7"
},
{
"url": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28387"
},
{
"url": "https://openssl-library.org/news/secadv/20260407.txt"
},
{
"url": "https://ubuntu.com/security/notices/USN-8155-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8155-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28387"
},
{
"url": "https://www.openwall.com/lists/oss-security/2026/04/07/11"
}
],
"published": "2026-04-07T22:16:20+00:00",
"updated": "2026-05-12T13:17:33+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-28388",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "julia"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 5.9,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
476
],
"description": "Issue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-28388"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-28388"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
},
{
"url": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e"
},
{
"url": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139"
},
{
"url": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3"
},
{
"url": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8"
},
{
"url": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28388"
},
{
"url": "https://openssl-library.org/news/secadv/20260407.txt"
},
{
"url": "https://ubuntu.com/security/notices/USN-8155-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8155-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28388"
},
{
"url": "https://www.openwall.com/lists/oss-security/2026/04/07/11"
}
],
"published": "2026-04-07T22:16:20+00:00",
"updated": "2026-05-12T13:17:33+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-28389",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "julia"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 5.9,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
476
],
"description": "Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-28389"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-28389"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
},
{
"url": "https://github.com/advisories/GHSA-7x88-9hgc-69gf"
},
{
"url": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5"
},
{
"url": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616"
},
{
"url": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f"
},
{
"url": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a"
},
{
"url": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28389"
},
{
"url": "https://openssl-library.org/news/secadv/20260407.txt"
},
{
"url": "https://ubuntu.com/security/notices/USN-8155-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8155-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28389"
},
{
"url": "https://www.openwall.com/lists/oss-security/2026/04/07/11"
}
],
"published": "2026-04-07T22:16:21+00:00",
"updated": "2026-05-12T13:17:33+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-28390",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "julia"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "medium"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 7.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "rocky"
},
"severity": "medium"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
476
],
"description": "Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-28390"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:22313"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-28390"
},
{
"url": "https://bugzilla.redhat.com/2456314"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456314"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28390"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-22313.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:22312"
},
{
"url": "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc"
},
{
"url": "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6"
},
{
"url": "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4"
},
{
"url": "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788"
},
{
"url": "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75"
},
{
"url": "https://linux.oracle.com/cve/CVE-2026-28390.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2026-22315.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28390"
},
{
"url": "https://openssl-library.org/news/secadv/20260407.txt"
},
{
"url": "https://ubuntu.com/security/notices/USN-8155-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8155-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28390"
},
{
"url": "https://www.openwall.com/lists/oss-security/2026/04/07/11"
}
],
"published": "2026-04-07T22:16:21+00:00",
"updated": "2026-05-12T13:17:33+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "in_triage",
"justification": "",
"response": [],
"detail": "This CVE is under investigation by Confluent."
}
},
{
"id": "CVE-2026-29111",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "medium"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 7.8,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
{
"source": {
"name": "rocky"
},
"severity": "medium"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
269
],
"description": "systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known workarounds are available.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-29111"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:19213"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-29111"
},
{
"url": "https://bugzilla.redhat.com/2450505"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450505"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-29111"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-19213.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:19213"
},
{
"url": "https://github.com/systemd/systemd/commit/1d22f706bd04f45f8422e17fbde3f56ece17758a"
},
{
"url": "https://github.com/systemd/systemd/commit/20021e7686426052e3a7505425d7e12085feb2a6"
},
{
"url": "https://github.com/systemd/systemd/commit/21167006574d6b83813c7596759b474f56562412"
},
{
"url": "https://github.com/systemd/systemd/commit/3cee294fe8cf4fa0eff933ab21416d099942cabd"
},
{
"url": "https://github.com/systemd/systemd/commit/42aee39107fbdd7db1ccd402a2151822b2805e9f"
},
{
"url": "https://github.com/systemd/systemd/commit/54588d2dedff54bfb6036670820650e4ea74628f"
},
{
"url": "https://github.com/systemd/systemd/commit/7ac3220213690e8a8d6d2a6e81e43bd1dce01d69"
},
{
"url": "https://github.com/systemd/systemd/commit/80acea4ef80a4bb78560ed970c34952299b890d6"
},
{
"url": "https://github.com/systemd/systemd/commit/b5fd14693057e5f2c9b4a49603be64ec3608ff6c"
},
{
"url": "https://github.com/systemd/systemd/commit/efa6ba2ab625aaa160ac435a09e6482fc63bdbe8"
},
{
"url": "https://github.com/systemd/systemd/security/advisories/GHSA-gx6q-6f99-m764"
},
{
"url": "https://linux.oracle.com/cve/CVE-2026-29111.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2026-13677.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29111"
},
{
"url": "https://ubuntu.com/security/notices/USN-8119-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8119-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29111"
}
],
"published": "2026-03-23T22:16:26+00:00",
"updated": "2026-04-15T16:44:38+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "239-82.el8_10.16",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "239-82.el8_10.16",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "239-82.el8_10.16",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "in_triage",
"justification": "",
"response": [],
"detail": "This CVE is under investigation by Confluent."
}
},
{
"id": "CVE-2026-31789",
"ratings": [
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 9.8,
"severity": "critical",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "critical"
},
{
"source": {
"name": "redhat"
},
"score": 5.8,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
787
],
"description": "Issue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-31789"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-31789"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
},
{
"url": "https://github.com/advisories/GHSA-j79m-9jxq-788r"
},
{
"url": "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde"
},
{
"url": "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf"
},
{
"url": "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49"
},
{
"url": "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9"
},
{
"url": "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31789"
},
{
"url": "https://openssl-library.org/news/secadv/20260407.txt"
},
{
"url": "https://ubuntu.com/security/notices/USN-8155-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31789"
},
{
"url": "https://www.openwall.com/lists/oss-security/2026/04/07/11"
}
],
"published": "2026-04-07T22:16:21+00:00",
"updated": "2026-05-12T13:17:34+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-3219",
"source": {
"name": "ghsa",
"url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip"
},
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "low"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "photon"
},
"severity": "low"
},
{
"source": {
"name": "redhat"
},
"score": 5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N"
}
],
"cwes": [
434
],
"description": "pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing \"incorrect\" files according to the filename of the archive. New behavior only proceeds with installation if the file identifies uniquely as a ZIP or tar archive, not as both.",
"recommendation": "Upgrade pip to version 26.1",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-3219"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/04/20/8"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-3219"
},
{
"url": "https://github.com/pypa/pip"
},
{
"url": "https://github.com/pypa/pip/issues/13867"
},
{
"url": "https://github.com/pypa/pip/pull/13870"
},
{
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/QAJ5JIVWWCAJ4EZL2FP5MOOW35JS7LRJ"
},
{
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/QAJ5JIVWWCAJ4EZL2FP5MOOW35JS7LRJ/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3219"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3219"
}
],
"published": "2026-04-20T16:16:45+00:00",
"updated": "2026-04-20T21:16:36+00:00",
"affects": [
{
"ref": "pkg:pypi/pip@26.0.1",
"versions": [
{
"version": "26.0.1",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:pypi/pip@26.0.1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:pypi/pip@26.0.1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:pypi/pip@26.0.1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:pypi/pip@26.0.1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:pypi/pip@26.0.1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:pypi/pip@26.0.1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:pypi/pip@26.0.1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:pypi/pip@26.0.1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:pypi/pip@26.0.1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:pypi/pip@26.0.1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:pypi/pip@26.0.1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:pypi/pip@26.0.1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:pypi/pip@26.0.1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:pypi/pip@26.0.1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:pypi/pip@26.0.1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:pypi/pip@26.0.1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:pypi/pip@26.0.1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:pypi/pip@26.0.1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:pypi/pip@26.0.1"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-3276",
"ratings": [
{
"source": {
"name": "redhat"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
}
],
"cwes": [
407
],
"description": "unicodedata.normalize() can take excessive CPU time when processing\nspecially crafted Unicode input containing long runs of combining characters\nwith alternating Canonical Combining Class values.\nThis affects all normalization forms.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-3276"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/06/03/15"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-3276"
},
{
"url": "https://github.com/python/cpython/commit/6b505d1f41f8f3ea0fe5a4786d3a8fff1875cfc0"
},
{
"url": "https://github.com/python/cpython/commit/90748760d38ca3ac5fc6788a69becab905c95598"
},
{
"url": "https://github.com/python/cpython/commit/991224b1e8311c85f198f6dd8208bf8cff7fc26f"
},
{
"url": "https://github.com/python/cpython/commit/ba785b88add96acbf403d65cb157fb2743a33a32"
},
{
"url": "https://github.com/python/cpython/commit/c5512bd7c1dc28055660565275012766941d3066"
},
{
"url": "https://github.com/python/cpython/issues/149079"
},
{
"url": "https://github.com/python/cpython/pull/149080"
},
{
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/PP5HB4K7727OBBM76KA2ILID76K3OZGZ/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3276"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3276"
}
],
"published": "2026-06-03T16:16:29+00:00",
"updated": "2026-06-16T15:16:39+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-76.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-76.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-32776",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 6.2,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"cwes": [
476
],
"description": "libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-32776"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-32776"
},
{
"url": "https://github.com/libexpat/libexpat/pull/1158"
},
{
"url": "https://github.com/libexpat/libexpat/pull/1159"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32776"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32776"
}
],
"published": "2026-03-16T14:19:44+00:00",
"updated": "2026-03-17T15:52:09+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.5.0-2.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-32777",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "nvd"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 4,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
}
],
"cwes": [
835
],
"description": "libexpat before 2.7.5 allows an infinite loop while parsing DTD content.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-32777"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-32777"
},
{
"url": "https://github.com/libexpat/libexpat/issues/1161"
},
{
"url": "https://github.com/libexpat/libexpat/pull/1159"
},
{
"url": "https://github.com/libexpat/libexpat/pull/1162"
},
{
"url": "https://issues.oss-fuzz.com/issues/486993411"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32777"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32777"
}
],
"published": "2026-03-16T14:19:44+00:00",
"updated": "2026-03-17T15:52:34+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.5.0-2.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-32778",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "nvd"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.1,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"cwes": [
476
],
"description": "libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-32778"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-32778"
},
{
"url": "https://github.com/libexpat/libexpat/pull/1159"
},
{
"url": "https://github.com/libexpat/libexpat/pull/1163"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32778"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32778"
}
],
"published": "2026-03-16T14:19:44+00:00",
"updated": "2026-03-17T15:52:53+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.5.0-2.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-32792",
"ratings": [
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "redhat"
},
"score": 5.9,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
125,
166
],
"description": "NLnet Labs Unbound 1.6.2 up to and including version 1.25.0 has a denial of service vulnerability when compiled with DNSCrypt support ('--enable-dnscrypt'). A bad DNSCrypt query could underflow Unbound's DNSCrypt packet reading procedure that may lead to heap overflow. A malicious actor can exploit the vulnerability with a single bad DNSCrypt query that its decrypted plaintext consists entirely of '0x00' bytes and does not contain the expected '0x80' marker. Unbound would then start reading more bytes than necessary until it finds a non-'0x00' byte. Based on the underlying memory allocator and the memory layout, it could lead to heap overflow while reading followed by a crash. Likelihood of a crash is low, since it relies heavily on the underlying memory allocator and the memory layout. If the heap overflow does not happen, Unbound's later packet checks will deny the packet. Unbound 1.25.1 contains a patch with a fix to bound reading in the given buffer space.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-32792"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-32792"
},
{
"url": "https://nlnetlabs.nl/news/2026/May/20/unbound-1.25.1-released/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32792"
},
{
"url": "https://ubuntu.com/security/notices/USN-8282-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32792"
},
{
"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-32792.txt"
}
],
"published": "2026-05-20T10:16:26+00:00",
"updated": "2026-05-20T22:44:09+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.16.2-5.10.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.16.2-5.10.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-33056",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "ghsa"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
},
{
"source": {
"name": "nvd"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
},
{
"source": {
"name": "redhat"
},
"score": 4.4,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
61
],
"description": "tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory \u2014 and subsequently apply chmod to it. This allows an attacker to modify the permissions of arbitrary directories outside the extraction root. This issue has been fixed in version 0.4.45.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-33056"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-33056"
},
{
"url": "https://github.com/alexcrichton/tar-rs"
},
{
"url": "https://github.com/alexcrichton/tar-rs/commit/17b1fd84e632071cb8eef9d3709bf347bd266446"
},
{
"url": "https://github.com/alexcrichton/tar-rs/security/advisories/GHSA-j4xf-2g29-59ph"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33056"
},
{
"url": "https://rustsec.org/advisories/RUSTSEC-2026-0067.html"
},
{
"url": "https://ubuntu.com/security/notices/USN-8138-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8139-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8168-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33056"
}
],
"published": "2026-03-20T08:16:11+00:00",
"updated": "2026-03-24T16:17:11+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2",
"versions": [
{
"version": "2:1.30-11.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-34180",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
125
],
"description": "Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive\nelement whose content exceeds 2 gigabytes in length may cause a heap buffer\nover-read on 64-bit Unix and Unix-like platforms.\n\nImpact summary: The heap buffer over-read may crash the application (Denial of\nService) or to load into the decoded ASN.1 object contents of memory beyond the\nend of the input buffer. More typically such ASN.1 elements would instead be\ntruncated.\n\nAn integer truncation in OpenSSL's ASN.1 decoder causes the content length of\nan ASN.1 primitive element to be mishandled when it exceeds 2 gigabytes. In the\nworst case the truncated length is treated as a request to scan the binary\ncontent for a terminating zero byte, possibly causing OpenSSL to read either\nless than or beyond the end of the allocated buffer.\n\nApplications that pass attacker-supplied data to d2i_X509(), d2i_PKCS7(), or\nany other d2i_* decoding function are affected. OpenSSL's own command-line\ntools are not vulnerable, as data read through the BIO layer is checked before\nit reaches the affected code. The issue only affects 64-bit Unix and Unix-like\nplatforms; 32-bit platforms and 64-bit Windows are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-34180"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:25239"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-34180"
},
{
"url": "https://bugzilla.redhat.com/2481879"
},
{
"url": "https://bugzilla.redhat.com/2481880"
},
{
"url": "https://bugzilla.redhat.com/2481881"
},
{
"url": "https://bugzilla.redhat.com/2481882"
},
{
"url": "https://bugzilla.redhat.com/2481884"
},
{
"url": "https://bugzilla.redhat.com/2481885"
},
{
"url": "https://bugzilla.redhat.com/2481887"
},
{
"url": "https://bugzilla.redhat.com/2481890"
},
{
"url": "https://bugzilla.redhat.com/2481891"
},
{
"url": "https://bugzilla.redhat.com/2481892"
},
{
"url": "https://bugzilla.redhat.com/2481893"
},
{
"url": "https://bugzilla.redhat.com/2481894"
},
{
"url": "https://bugzilla.redhat.com/2481896"
},
{
"url": "https://bugzilla.redhat.com/2481897"
},
{
"url": "https://bugzilla.redhat.com/2481898"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481879"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481880"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481881"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481882"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481884"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481885"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481887"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481890"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481891"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481892"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481893"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481894"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481896"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481897"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34180"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34181"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34182"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34183"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42764"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42766"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42767"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42768"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42769"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42770"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45445"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45446"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45447"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7383"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9076"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-25239.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:25237"
},
{
"url": "https://github.com/openssl/openssl/commit/1c6908e4fa5fa568752221d8eaf561a809751e5d"
},
{
"url": "https://github.com/openssl/openssl/commit/cbe418ae978539cf14a398a207dba834c0e93e83"
},
{
"url": "https://github.com/openssl/openssl/commit/d93853c42110d6319e3df07842b488cb9f7ac5ff"
},
{
"url": "https://github.com/openssl/openssl/commit/da5d62af75f69d6fbf7803743d7c56ac75461e43"
},
{
"url": "https://github.com/openssl/openssl/commit/f696c73c3e61b8c502d040af62e690c060908a16"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34180"
},
{
"url": "https://openssl-library.org/news/secadv/20260609.txt"
},
{
"url": "https://ubuntu.com/security/notices/USN-8414-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8414-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34180"
}
],
"published": "2026-06-09T17:17:04+00:00",
"updated": "2026-06-15T18:13:21+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
}
},
{
"id": "CVE-2026-34181",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 6.3,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
354
],
"description": "Issue Summary: The PKCS#12 file processing fails to perform sufficient input\nvalidation for files that use Password-Based Message Authentication Code 1\n(PBMAC1) integrity mechanism allowing a certificate and private key forgery.\n\nImpact Summary: An attacker impersonating a user can cause a service reading\nPKCS#12 files to accept forged certificates and private keys with a 1 in 256\nprobability.\n\nIf a service accepting PKCS#12 files is using passwords for authenticating\nthe received files, the attacker can create unencrypted PKCS#12 files that\nuse PBMAC1 authentication that specifies an HMAC key of only one byte, allowing\nthem to craft a file that will be accepted with a 1 in 256 probability.\nThat would then cause the service to accept a certificate and private key\ncontrolled by the attacker.\n\nThe FIPS modules are not affected by this issue, as the affected code is\noutside the OpenSSL FIPS module boundary.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-34181"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:25239"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-34181"
},
{
"url": "https://bugzilla.redhat.com/2481879"
},
{
"url": "https://bugzilla.redhat.com/2481880"
},
{
"url": "https://bugzilla.redhat.com/2481881"
},
{
"url": "https://bugzilla.redhat.com/2481882"
},
{
"url": "https://bugzilla.redhat.com/2481884"
},
{
"url": "https://bugzilla.redhat.com/2481885"
},
{
"url": "https://bugzilla.redhat.com/2481887"
},
{
"url": "https://bugzilla.redhat.com/2481890"
},
{
"url": "https://bugzilla.redhat.com/2481891"
},
{
"url": "https://bugzilla.redhat.com/2481892"
},
{
"url": "https://bugzilla.redhat.com/2481893"
},
{
"url": "https://bugzilla.redhat.com/2481894"
},
{
"url": "https://bugzilla.redhat.com/2481896"
},
{
"url": "https://bugzilla.redhat.com/2481897"
},
{
"url": "https://bugzilla.redhat.com/2481898"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481879"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481880"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481881"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481882"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481884"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481885"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481887"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481890"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481891"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481892"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481893"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481894"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481896"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481897"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34180"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34181"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34182"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34183"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42764"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42766"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42767"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42768"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42769"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42770"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45445"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45446"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45447"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7383"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9076"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-25239.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:25237"
},
{
"url": "https://github.com/openssl/openssl/commit/0300eb9ddce7a0895bf301a4b0c03a9da2313a0f"
},
{
"url": "https://github.com/openssl/openssl/commit/79eb76a937e474bb7610a0a3dc57131dc8dc6610"
},
{
"url": "https://github.com/openssl/openssl/commit/85dcbb3abaa4878af5c8fbbe11bce708fcf984a7"
},
{
"url": "https://github.com/openssl/openssl/commit/ec36f2417c4ddd8cabce4b4a60a3d7a7365f2d81"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34181"
},
{
"url": "https://openssl-library.org/news/secadv/20260609.txt"
},
{
"url": "https://ubuntu.com/security/notices/USN-8414-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34181"
}
],
"published": "2026-06-09T17:17:04+00:00",
"updated": "2026-06-15T18:13:13+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
}
},
{
"id": "CVE-2026-34182",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "critical"
},
{
"source": {
"name": "redhat"
},
"score": 7.4,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
354
],
"description": "Issue Summary: Cryptographic Message Services (CMS) processing fails to perform\nsufficient input validation on the cipher and tag length fields of\nAuthEnvelopedData containers, leading to various potential compromises.\n\nImpact Summary: Attackers making use of these vulnerabilities may achieve\nkey-equivalent functionality for a given CMS recipient and/or bypass integrity\nvalidation for a given message.\n\nIn one use case, an attacker may send a CMS message containing\nAuthEnvelopedData with the cipher specified as a non-AEAD cipher. OpenSSL\nerroneously allows this selection, and attempts to decrypt and validate the\nmessage.\n\nAn on-path attacker who captures one legitimate AES-GCM AuthEnvelopedData\naddressed to the victim can re-emit it with the recipientInfos set left\nbyte-for-byte intact, so the victim's private key still unwraps the genuine CEK\n(the content-encryption key), but with the inner OID rewritten to AES-256-OFB\n(Output Feedback Mode, an unauthenticated keystream mode) and with an\nattacker-chosen IV and ciphertext. The victim initializes AES-256-OFB under the\nreal CEK, never consults the MAC field, and CMS_decrypt() returns success.\n\nIf the application under attack responds to the attacker with any indicator\nshowing success or failure of the decryption effort, it is possible for the\nattacker to use this as an oracle to obtain key equivalent functionality for the\nCEK used for the chosen recipient of the message.\n\nIn another use case, an attacker can reduce the tag length of the chosen AEAD\ncipher for a given AuthEnvelopedData container to be a single byte long,\nallowing an attacker to brute force CMS decryption, producing an integrity\nbypass for applications that trust CMS_decrypt() to reject modified content.\n\nThe FIPS modules are not affected by this issue.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-34182"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:25239"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-34182"
},
{
"url": "https://bugzilla.redhat.com/2481879"
},
{
"url": "https://bugzilla.redhat.com/2481880"
},
{
"url": "https://bugzilla.redhat.com/2481881"
},
{
"url": "https://bugzilla.redhat.com/2481882"
},
{
"url": "https://bugzilla.redhat.com/2481884"
},
{
"url": "https://bugzilla.redhat.com/2481885"
},
{
"url": "https://bugzilla.redhat.com/2481887"
},
{
"url": "https://bugzilla.redhat.com/2481890"
},
{
"url": "https://bugzilla.redhat.com/2481891"
},
{
"url": "https://bugzilla.redhat.com/2481892"
},
{
"url": "https://bugzilla.redhat.com/2481893"
},
{
"url": "https://bugzilla.redhat.com/2481894"
},
{
"url": "https://bugzilla.redhat.com/2481896"
},
{
"url": "https://bugzilla.redhat.com/2481897"
},
{
"url": "https://bugzilla.redhat.com/2481898"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481879"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481880"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481881"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481882"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481884"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481885"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481887"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481890"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481891"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481892"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481893"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481894"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481896"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481897"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34180"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34181"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34182"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34183"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42764"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42766"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42767"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42768"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42769"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42770"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45445"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45446"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45447"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7383"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9076"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-25239.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:25237"
},
{
"url": "https://github.com/openssl/openssl/commit/03c1f4d45fb963aee7d5833390c507cd290182bc"
},
{
"url": "https://github.com/openssl/openssl/commit/439ed7d2c0962ce964482727264668bf277c333f"
},
{
"url": "https://github.com/openssl/openssl/commit/7947e6a81eb8776802f159fb6762cb7fcf7e34c7"
},
{
"url": "https://github.com/openssl/openssl/commit/9fd97f8cfdc2c0be214998de3b2b55c8edf6c7ac"
},
{
"url": "https://github.com/openssl/openssl/commit/d2ca86bcd43e4f17d899f347101766b6107676e0"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34182"
},
{
"url": "https://openssl-library.org/news/secadv/20260609.txt"
},
{
"url": "https://ubuntu.com/security/notices/USN-8414-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8414-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34182"
}
],
"published": "2026-06-09T17:17:04+00:00",
"updated": "2026-06-15T18:13:05+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "in_triage",
"justification": "",
"response": [],
"detail": "This CVE is under investigation by Confluent."
}
},
{
"id": "CVE-2026-34183",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 7.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
1325
],
"description": "Issue summary: Remote peer may exhaust heap memory of the QUIC\nserver or client by flooding it with packets containing PATH_CHALLENGE\nframes.\n\nImpact summary: A malicious remote peer can cause an unbounded\nmemory allocation which can lead to an abnormal termination of the\napplication acting as a QUIC client or server and a Denial of Service.\n\nA remote peer may exhaust heap memory by flooding the local\nQUIC stack with PATH_CHALLENGE frames. The local QUIC stack\nallocates a PATH_RESPONSE frame for every PATH_CHALLENGE it receives.\nThe allocated PATH_RESPONSE frame gets freed only when the remote\npeer acknowledges reception of the PATH_RESPONSE frame which will\nnot be done by a malicious peer.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by\nthis issue. The QUIC stack is outside of OpenSSL FIPS module\nboundary.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-34183"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:25239"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-34183"
},
{
"url": "https://bugzilla.redhat.com/2481879"
},
{
"url": "https://bugzilla.redhat.com/2481880"
},
{
"url": "https://bugzilla.redhat.com/2481881"
},
{
"url": "https://bugzilla.redhat.com/2481882"
},
{
"url": "https://bugzilla.redhat.com/2481884"
},
{
"url": "https://bugzilla.redhat.com/2481885"
},
{
"url": "https://bugzilla.redhat.com/2481887"
},
{
"url": "https://bugzilla.redhat.com/2481890"
},
{
"url": "https://bugzilla.redhat.com/2481891"
},
{
"url": "https://bugzilla.redhat.com/2481892"
},
{
"url": "https://bugzilla.redhat.com/2481893"
},
{
"url": "https://bugzilla.redhat.com/2481894"
},
{
"url": "https://bugzilla.redhat.com/2481896"
},
{
"url": "https://bugzilla.redhat.com/2481897"
},
{
"url": "https://bugzilla.redhat.com/2481898"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481879"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481880"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481881"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481882"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481884"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481885"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481887"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481890"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481891"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481892"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481893"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481894"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481896"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481897"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34180"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34181"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34182"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34183"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42764"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42766"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42767"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42768"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42769"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42770"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45445"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45446"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45447"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7383"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9076"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-25239.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:25237"
},
{
"url": "https://github.com/openssl/openssl/commit/5b306efb0b3779dfdd0803b4afc9d08c91f11517"
},
{
"url": "https://github.com/openssl/openssl/commit/7d06955ebe0ecf8adfd4c1e92018586da47ef9ac"
},
{
"url": "https://github.com/openssl/openssl/commit/d2e9efbe4900a373227deb136e8665401404ffac"
},
{
"url": "https://github.com/openssl/openssl/commit/fbaa83859c01ad64f497b757aaf51be7d05ed9eb"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34183"
},
{
"url": "https://openssl-library.org/news/secadv/20260609.txt"
},
{
"url": "https://ubuntu.com/security/notices/USN-8414-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34183"
}
],
"published": "2026-06-09T17:17:05+00:00",
"updated": "2026-06-15T18:12:39+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "in_triage",
"justification": "",
"response": [],
"detail": "This CVE is under investigation by Confluent."
}
},
{
"id": "CVE-2026-34743",
"ratings": [
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "nvd"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
122
],
"description": "XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-34743"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/03/31/13"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-34743"
},
{
"url": "https://github.com/tukaani-project/xz/commit/c8c22869e780ff57c96b46939c3d79ff99395f87"
},
{
"url": "https://github.com/tukaani-project/xz/releases/tag/v5.8.3"
},
{
"url": "https://github.com/tukaani-project/xz/security/advisories/GHSA-x872-m794-cxhv"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34743"
},
{
"url": "https://tukaani.org/xz/index-append-overflow.html"
},
{
"url": "https://ubuntu.com/security/notices/USN-8362-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34743"
}
],
"published": "2026-04-02T19:21:33+00:00",
"updated": "2026-04-15T17:33:17+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/xz-libs@5.2.4-4.el8_6?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "5.2.4-4.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/xz-libs@5.2.4-4.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/xz-libs@5.2.4-4.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/xz-libs@5.2.4-4.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/xz-libs@5.2.4-4.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/xz-libs@5.2.4-4.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/xz-libs@5.2.4-4.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/xz-libs@5.2.4-4.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/xz-libs@5.2.4-4.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/xz-libs@5.2.4-4.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/xz-libs@5.2.4-4.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/xz-libs@5.2.4-4.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/xz-libs@5.2.4-4.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/xz-libs@5.2.4-4.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/xz-libs@5.2.4-4.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/xz-libs@5.2.4-4.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/xz-libs@5.2.4-4.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/xz-libs@5.2.4-4.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/xz-libs@5.2.4-4.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/xz-libs@5.2.4-4.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/xz-libs@5.2.4-4.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/xz-libs@5.2.4-4.el8_6?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-3479",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 3.3,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
}
],
"cwes": [
22
],
"description": "DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation has been updated to clarify this point. There is no vulnerability in the function if following the intended security model.\n\npkgutil.get_data() did not validate the resource argument as documented, allowing path traversals.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-3479"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-3479"
},
{
"url": "https://github.com/python/cpython/commit/5af6ce3e7b643a30a02d22245c1e3f4a8bc0a1fe"
},
{
"url": "https://github.com/python/cpython/commit/bcdf231946b1da8bdfbab4c05539bb0cc964a1c7"
},
{
"url": "https://github.com/python/cpython/commit/cf59bf76470f3d75ad47d80ffb8ce76b64b5e943"
},
{
"url": "https://github.com/python/cpython/commit/d786d59a8f7196bb630100a869f28ad13436b59c"
},
{
"url": "https://github.com/python/cpython/issues/146121"
},
{
"url": "https://github.com/python/cpython/pull/146122"
},
{
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/WYLLVQOOCKGK73JM7Z7ZSNOJC4N7BAWY/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3479"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3479"
}
],
"published": "2026-03-18T19:16:06+00:00",
"updated": "2026-04-07T18:16:46+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-76.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-76.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-3644",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 5.4,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
}
],
"cwes": [
20,
116
],
"description": "The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-3644"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:19177"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-3644"
},
{
"url": "https://bugzilla.redhat.com/2395108"
},
{
"url": "https://bugzilla.redhat.com/2408891"
},
{
"url": "https://bugzilla.redhat.com/2418084"
},
{
"url": "https://bugzilla.redhat.com/2431366"
},
{
"url": "https://bugzilla.redhat.com/2431374"
},
{
"url": "https://bugzilla.redhat.com/2444691"
},
{
"url": "https://bugzilla.redhat.com/2448168"
},
{
"url": "https://bugzilla.redhat.com/2448181"
},
{
"url": "https://bugzilla.redhat.com/2449649"
},
{
"url": "https://bugzilla.redhat.com/2457409"
},
{
"url": "https://bugzilla.redhat.com/2457932"
},
{
"url": "https://bugzilla.redhat.com/2458049"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2395108"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2408891"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418084"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431366"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431374"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444691"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448168"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448181"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449649"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457409"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457932"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458049"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13837"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15282"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59375"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6075"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0672"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1502"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2297"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3644"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4224"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4519"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4786"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6100"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-19177.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:19177"
},
{
"url": "https://github.com/python/cpython/commit/57e88c1cf95e1481b94ae57abe1010469d47a6b4"
},
{
"url": "https://github.com/python/cpython/commit/62ceb396fcbe69da1ded3702de586f4072b590dd"
},
{
"url": "https://github.com/python/cpython/commit/d16ecc6c3626f0e2cc8f08c309c83934e8a979dd"
},
{
"url": "https://github.com/python/cpython/issues/145599"
},
{
"url": "https://github.com/python/cpython/pull/145600"
},
{
"url": "https://linux.oracle.com/cve/CVE-2026-3644.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2026-10950.html"
},
{
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/H6CADMBCDRFGWCMOXWUIHFJNV43GABJ7/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3644"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3644"
}
],
"published": "2026-03-16T18:16:09+00:00",
"updated": "2026-06-04T19:30:28+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-76.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-76.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-3731",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
119,
125
],
"description": "A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected component.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-3731"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-3731"
},
{
"url": "https://gitlab.com/libssh/libssh-mirror/-/commit/855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3731"
},
{
"url": "https://ubuntu.com/security/notices/USN-8093-1"
},
{
"url": "https://vuldb.com/?ctiid.349709"
},
{
"url": "https://vuldb.com/?id.349709"
},
{
"url": "https://vuldb.com/?submit.767120"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3731"
},
{
"url": "https://www.libssh.org/files/0.12/libssh-0.12.0.tar.xz"
},
{
"url": "https://www.libssh.org/security/advisories/libssh-2026-sftp-extensions.txt"
}
],
"published": "2026-03-08T11:15:50+00:00",
"updated": "2026-03-12T19:02:31+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "0.9.6-16.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "0.9.6-16.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-3783",
"ratings": [
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "julia"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.7,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
522
],
"description": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a redirect to a second URL, curl could leak that token to the second\nhostname under some circumstances.\n\nIf the hostname that the first request is redirected to has information in the\nused .netrc file, with either of the `machine` or `default` keywords, curl\nwould pass on the bearer token set for the first host also to the second one.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-3783"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/03/11/2"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-3783"
},
{
"url": "https://curl.se/docs/CVE-2026-3783.html"
},
{
"url": "https://curl.se/docs/CVE-2026-3783.json"
},
{
"url": "https://github.com/advisories/GHSA-8whr-249c-vfjp"
},
{
"url": "https://hackerone.com/reports/3583983"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3783"
},
{
"url": "https://ubuntu.com/security/notices/USN-8084-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8099-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3783"
}
],
"published": "2026-03-11T11:16:00+00:00",
"updated": "2026-03-12T14:10:37+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.11",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.11",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-3784",
"ratings": [
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "julia"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
305
],
"description": "curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a\nserver, even if the new request uses different credentials for the HTTP proxy.\nThe proper behavior is to create or use a separate connection.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-3784"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/03/11/3"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-3784"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
},
{
"url": "https://curl.se/docs/CVE-2026-3784.html"
},
{
"url": "https://curl.se/docs/CVE-2026-3784.json"
},
{
"url": "https://github.com/advisories/GHSA-5q3w-6p3j-mw6p"
},
{
"url": "https://hackerone.com/reports/3584903"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3784"
},
{
"url": "https://ubuntu.com/security/notices/USN-8084-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8099-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3784"
}
],
"published": "2026-03-11T11:16:00+00:00",
"updated": "2026-06-02T14:16:52+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.11",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.11",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-3805",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "julia"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 6.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
416
],
"description": "When doing a second SMB request to the same host again, curl would wrongly use\na data pointer pointing into already freed memory.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-3805"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/03/11/4"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-3805"
},
{
"url": "https://curl.se/docs/CVE-2026-3805.html"
},
{
"url": "https://curl.se/docs/CVE-2026-3805.json"
},
{
"url": "https://github.com/advisories/GHSA-2289-hhfc-p684"
},
{
"url": "https://hackerone.com/reports/3591944"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3805"
},
{
"url": "https://ubuntu.com/security/notices/USN-8084-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3805"
}
],
"published": "2026-03-11T11:16:00+00:00",
"updated": "2026-03-12T14:08:56+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.11",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.11",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-3832",
"ratings": [
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "redhat"
},
"score": 3.7,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
179
],
"description": "A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted Online Certificate Status Protocol (OCSP) response during a TLS handshake. Due to a logic error in how gnutls processes multi-record OCSP responses, a client with OCSP verification enabled may incorrectly accept a revoked server certificate, potentially leading to a compromise of trust.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-3832"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:13274"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:20612"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:20613"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-3832"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445762"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445763"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450624"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450625"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467279"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467289"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467437"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467441"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467448"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467450"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467451"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467678"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467686"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33845"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33846"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3832"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3833"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42009"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42010"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42011"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42012"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42013"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42014"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42015"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5260"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5419"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:20612"
},
{
"url": "https://gitlab.com/gnutls/gnutls/-/issues/1801"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3832"
},
{
"url": "https://ubuntu.com/security/notices/USN-8284-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3832"
},
{
"url": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-12"
}
],
"published": "2026-04-30T18:16:30+00:00",
"updated": "2026-06-02T17:16:28+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.16-8.el8_10.6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-4105",
"ratings": [
{
"source": {
"name": "redhat"
},
"score": 6.7,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"
}
],
"cwes": [
284
],
"description": "A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with root privileges on the host system.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-4105"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:7299"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-4105"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447262"
},
{
"url": "https://github.com/systemd/systemd/security/advisories/GHSA-4h6x-r8vx-3862"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4105"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4105"
}
],
"published": "2026-03-13T19:55:13+00:00",
"updated": "2026-04-30T17:16:26+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "239-82.el8_10.16",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "239-82.el8_10.16",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "239-82.el8_10.16",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/systemd@239-82.el8_10.16?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-41080",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "low"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 3.7,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
}
],
"cwes": [
331
],
"description": "libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-41080"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/04/26/1"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-41080"
},
{
"url": "https://blog.hartwork.org/posts/expat-2-8-0-released/"
},
{
"url": "https://github.com/libexpat/libexpat/issues/47"
},
{
"url": "https://github.com/libexpat/libexpat/pull/1183"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41080"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41080"
},
{
"url": "https://www.openwall.com/lists/oss-security/2026/04/26/1"
}
],
"published": "2026-04-16T17:16:54+00:00",
"updated": "2026-06-12T18:43:00+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.5.0-2.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-41989",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "julia"
},
"score": 6.7,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 7.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
787
],
"description": "Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcry_pk_decrypt.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-41989"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-41989"
},
{
"url": "https://dev.gnupg.org/T8211"
},
{
"url": "https://github.com/advisories/GHSA-wrv8-79m2-qg24"
},
{
"url": "https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000503.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41989"
},
{
"url": "https://ubuntu.com/security/notices/USN-8319-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41989"
},
{
"url": "https://www.openwall.com/lists/oss-security/2026/04/21/1"
}
],
"published": "2026-04-23T05:16:05+00:00",
"updated": "2026-04-27T18:33:18+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.8.5-7.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "in_triage",
"justification": "",
"response": [],
"detail": "This CVE is under investigation by Confluent."
}
},
{
"id": "CVE-2026-41990",
"ratings": [
{
"source": {
"name": "julia"
},
"score": 4,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"
},
{
"source": {
"name": "redhat"
},
"score": 3.3,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
787
],
"description": "Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attacker-controlled data.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-41990"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-41990"
},
{
"url": "https://dev.gnupg.org/T8208"
},
{
"url": "https://github.com/advisories/GHSA-78pv-qq8x-94px"
},
{
"url": "https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000503.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41990"
},
{
"url": "https://ubuntu.com/security/notices/USN-8319-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41990"
},
{
"url": "https://www.openwall.com/lists/oss-security/2026/04/21/1"
}
],
"published": "2026-04-23T05:16:05+00:00",
"updated": "2026-04-27T18:33:27+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.8.5-7.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-4224",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 5.9,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
}
],
"cwes": [
674
],
"description": "When an Expat parser with a registered ElementDeclHandler parses an inline\ndocument type definition containing a deeply nested content model a C stack\noverflow occurs.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-4224"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/03/16/4"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:19177"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-4224"
},
{
"url": "https://bugzilla.redhat.com/2395108"
},
{
"url": "https://bugzilla.redhat.com/2408891"
},
{
"url": "https://bugzilla.redhat.com/2418084"
},
{
"url": "https://bugzilla.redhat.com/2431366"
},
{
"url": "https://bugzilla.redhat.com/2431374"
},
{
"url": "https://bugzilla.redhat.com/2444691"
},
{
"url": "https://bugzilla.redhat.com/2448168"
},
{
"url": "https://bugzilla.redhat.com/2448181"
},
{
"url": "https://bugzilla.redhat.com/2449649"
},
{
"url": "https://bugzilla.redhat.com/2457409"
},
{
"url": "https://bugzilla.redhat.com/2457932"
},
{
"url": "https://bugzilla.redhat.com/2458049"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2395108"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2408891"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418084"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431366"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431374"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444691"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448168"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448181"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449649"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457409"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457932"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458049"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13837"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15282"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59375"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6075"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0672"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1502"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2297"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3644"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4224"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4519"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4786"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6100"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-19177.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:19177"
},
{
"url": "https://github.com/python/cpython/commit/196edfb06a7458377d4d0f4b3cd41724c1f3bd4a"
},
{
"url": "https://github.com/python/cpython/commit/642865ddf4b232da1f3b1f7abcfa3254c4bfe785"
},
{
"url": "https://github.com/python/cpython/commit/af856a7177326ac25d9f66cc6dd28b554d914fee"
},
{
"url": "https://github.com/python/cpython/commit/e0a8a6da90597a924b300debe045cdb4628ee1f3"
},
{
"url": "https://github.com/python/cpython/commit/eb0e8be3a7e11b87d198a2c3af1ed0eccf532768"
},
{
"url": "https://github.com/python/cpython/issues/145986"
},
{
"url": "https://github.com/python/cpython/pull/145987"
},
{
"url": "https://linux.oracle.com/cve/CVE-2026-4224.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2026-10950.html"
},
{
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/5M7CGUW3XBRY7II4DK43KF7NQQ3TPZ6R/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4224"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4224"
}
],
"published": "2026-03-16T18:16:10+00:00",
"updated": "2026-06-04T19:33:19+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-76.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-76.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-42250",
"ratings": [
{
"source": {
"name": "redhat"
},
"score": 5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H"
}
],
"cwes": [
787
],
"description": "bzip2 contains an off\u2011by\u2011one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out\u2011of\u2011bounds write to a global buffer, resulting in memory corruption and a crash (denial of service).\n\nThis issue was fixed in bzip2 patch\u00a035d122a3df8b0cc4082a4d89fdc6ee99f375fe67",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-42250"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-42250"
},
{
"url": "https://cert.pl/en/posts/2026/05/CVE-2026-42250/"
},
{
"url": "https://inbox.sourceware.org/bzip2-devel/20260528145407.293768-1-mark@klomp.org/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42250"
},
{
"url": "https://sourceware.org/bzip2/"
},
{
"url": "https://sourceware.org/cgit/bzip2/commit/?id=35d122a3df8b0cc4082a4d89fdc6ee99f375fe67"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42250"
}
],
"published": "2026-05-28T14:16:19+00:00",
"updated": "2026-06-05T08:16:30+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/bzip2-libs@1.0.6-28.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.0.6-28.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/bzip2-libs@1.0.6-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/bzip2-libs@1.0.6-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/bzip2-libs@1.0.6-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/bzip2-libs@1.0.6-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/bzip2-libs@1.0.6-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/bzip2-libs@1.0.6-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/bzip2-libs@1.0.6-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/bzip2-libs@1.0.6-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/bzip2-libs@1.0.6-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/bzip2-libs@1.0.6-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/bzip2-libs@1.0.6-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/bzip2-libs@1.0.6-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/bzip2-libs@1.0.6-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/bzip2-libs@1.0.6-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/bzip2-libs@1.0.6-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/bzip2-libs@1.0.6-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/bzip2-libs@1.0.6-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/bzip2-libs@1.0.6-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/bzip2-libs@1.0.6-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/bzip2-libs@1.0.6-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/bzip2-libs@1.0.6-28.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-42308",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "ghsa"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "nvd"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 6.2,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
190
],
"description": "Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-42308"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-42308"
},
{
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-165.yaml"
},
{
"url": "https://github.com/python-pillow/Pillow"
},
{
"url": "https://github.com/python-pillow/Pillow/pull/9518/changes"
},
{
"url": "https://github.com/python-pillow/Pillow/releases/tag/12.2.0"
},
{
"url": "https://github.com/python-pillow/Pillow/security/advisories/GHSA-wjx4-4jcj-g98j"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42308"
},
{
"url": "https://ubuntu.com/security/notices/USN-8399-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42308"
}
],
"published": "2026-05-09T06:16:09+00:00",
"updated": "2026-05-12T17:57:20+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-76.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-76.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-42764",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 5.9,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
476
],
"description": "Issue summary: Receiving a QUIC initial packet with an invalid token may\ntrigger a NULL pointer dereference in the OpenSSL QUIC server with\naddress validation disabled.\n\nImpact summary: NULL pointer dereference typically causes abnormal termination\nof the affected QUIC server process and a Denial of Service.\n\nIf the address validation is disabled in the OpenSSL QUIC server\nimplementation, an attacker can crash the server by sending an initial\npacket with an invalid or expired token.\n\nBy default, the client address validation is enabled in the OpenSSL QUIC server\nimplementation, which makes the default configuration not vulnerable\nto this issue. However if the SSL_LISTENER_FLAG_NO_VALIDATE is used with\nthe SSL_new_listener() call, the address validation is disabled making the\nvulnerable code reachable.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-42764"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:25239"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-42764"
},
{
"url": "https://bugzilla.redhat.com/2481879"
},
{
"url": "https://bugzilla.redhat.com/2481880"
},
{
"url": "https://bugzilla.redhat.com/2481881"
},
{
"url": "https://bugzilla.redhat.com/2481882"
},
{
"url": "https://bugzilla.redhat.com/2481884"
},
{
"url": "https://bugzilla.redhat.com/2481885"
},
{
"url": "https://bugzilla.redhat.com/2481887"
},
{
"url": "https://bugzilla.redhat.com/2481890"
},
{
"url": "https://bugzilla.redhat.com/2481891"
},
{
"url": "https://bugzilla.redhat.com/2481892"
},
{
"url": "https://bugzilla.redhat.com/2481893"
},
{
"url": "https://bugzilla.redhat.com/2481894"
},
{
"url": "https://bugzilla.redhat.com/2481896"
},
{
"url": "https://bugzilla.redhat.com/2481897"
},
{
"url": "https://bugzilla.redhat.com/2481898"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481879"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481880"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481881"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481882"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481884"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481885"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481887"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481890"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481891"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481892"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481893"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481894"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481896"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481897"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34180"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34181"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34182"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34183"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42764"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42766"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42767"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42768"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42769"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42770"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45445"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45446"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45447"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7383"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9076"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-25239.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:25237"
},
{
"url": "https://github.com/openssl/openssl/commit/5e3ed291b8af0b03d5d3b9e56a1da69a187e9729"
},
{
"url": "https://github.com/openssl/openssl/commit/a45a0aba8095682c88ff4fc4a784892b8c6f0677"
},
{
"url": "https://github.com/openssl/openssl/commit/bf29a458c1a231eca87e384c62b9c2553fa57a91"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42764"
},
{
"url": "https://openssl-library.org/news/secadv/20260609.txt"
},
{
"url": "https://ubuntu.com/security/notices/USN-8414-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42764"
}
],
"published": "2026-06-09T17:17:07+00:00",
"updated": "2026-06-15T18:25:25+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
}
},
{
"id": "CVE-2026-42766",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.3,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
476
],
"description": "Issue summary: A specially crafted password-encrypted CMS message\ncan trigger a NULL pointer dereference during CMS decryption.\n\nImpact summary: This NULL pointer dereference leads to an application crash\nand a Denial of Service.\n\nThe CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as\nOPTIONAL in the ASN.1 specification and may therefore be absent in specially\ncrafted inputs. During the password-based CMS decryption the OpenSSL\nCMS implementation dereferences this field without first checking whether it\nwas present.\n\nAn attacker who supplies such a CMS message to an application performing\npassword-based CMS decryption can trigger an application crash, leading to\na Denial of Service.\n\nApplications that process password-encrypted CMS messages may be affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-42766"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:25239"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-42766"
},
{
"url": "https://bugzilla.redhat.com/2481879"
},
{
"url": "https://bugzilla.redhat.com/2481880"
},
{
"url": "https://bugzilla.redhat.com/2481881"
},
{
"url": "https://bugzilla.redhat.com/2481882"
},
{
"url": "https://bugzilla.redhat.com/2481884"
},
{
"url": "https://bugzilla.redhat.com/2481885"
},
{
"url": "https://bugzilla.redhat.com/2481887"
},
{
"url": "https://bugzilla.redhat.com/2481890"
},
{
"url": "https://bugzilla.redhat.com/2481891"
},
{
"url": "https://bugzilla.redhat.com/2481892"
},
{
"url": "https://bugzilla.redhat.com/2481893"
},
{
"url": "https://bugzilla.redhat.com/2481894"
},
{
"url": "https://bugzilla.redhat.com/2481896"
},
{
"url": "https://bugzilla.redhat.com/2481897"
},
{
"url": "https://bugzilla.redhat.com/2481898"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481879"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481880"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481881"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481882"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481884"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481885"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481887"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481890"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481891"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481892"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481893"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481894"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481896"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481897"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34180"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34181"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34182"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34183"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42764"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42766"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42767"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42768"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42769"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42770"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45445"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45446"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45447"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7383"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9076"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-25239.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:25237"
},
{
"url": "https://github.com/openssl/openssl/commit/056d06c1918fafbb98c1c85a02e4c47cc4e199ce"
},
{
"url": "https://github.com/openssl/openssl/commit/12bc26ffb3a2be728c9b86e1cae277de5b33dfa4"
},
{
"url": "https://github.com/openssl/openssl/commit/3ff64913615d648cfbb6a6f1cf5529ae7ea829d7"
},
{
"url": "https://github.com/openssl/openssl/commit/ab52d88cb5374876d59aee3c91f9e4ccce2b7ce4"
},
{
"url": "https://github.com/openssl/openssl/commit/da26f368732b83e40e9d356fe61c3d3aaab6d2e8"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42766"
},
{
"url": "https://openssl-library.org/news/secadv/20260609.txt"
},
{
"url": "https://ubuntu.com/security/notices/USN-8414-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8414-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42766"
}
],
"published": "2026-06-09T17:17:07+00:00",
"updated": "2026-06-15T18:25:08+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
}
},
{
"id": "CVE-2026-42767",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.3,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
476
],
"description": "Issue summary: An attacker-controlled CMP (Certificate Management Protocol)\nserver could trigger a NULL pointer dereference in a CMP client application.\n\nImpact summary: A NULL pointer dereference causes a crash of the\napplication and a Denial of Service.\n\nAn attacker controlling a CMP server (or acting as a man-in-the-middle) could\ncraft a CMP response containing a CRMF (Certificate Request Message Format)\nCertRepMessage with an EncryptedValue structure where the symmAlg field\nhas an algorithm OID but no parameters field. When the OpenSSL CMP client\nprocesses this response, the NULL dereference occurs, causing a crash of\nthe CMP client.\n\nApplications that process untrusted CMP/CRMF messages may be affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-42767"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:25239"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-42767"
},
{
"url": "https://bugzilla.redhat.com/2481879"
},
{
"url": "https://bugzilla.redhat.com/2481880"
},
{
"url": "https://bugzilla.redhat.com/2481881"
},
{
"url": "https://bugzilla.redhat.com/2481882"
},
{
"url": "https://bugzilla.redhat.com/2481884"
},
{
"url": "https://bugzilla.redhat.com/2481885"
},
{
"url": "https://bugzilla.redhat.com/2481887"
},
{
"url": "https://bugzilla.redhat.com/2481890"
},
{
"url": "https://bugzilla.redhat.com/2481891"
},
{
"url": "https://bugzilla.redhat.com/2481892"
},
{
"url": "https://bugzilla.redhat.com/2481893"
},
{
"url": "https://bugzilla.redhat.com/2481894"
},
{
"url": "https://bugzilla.redhat.com/2481896"
},
{
"url": "https://bugzilla.redhat.com/2481897"
},
{
"url": "https://bugzilla.redhat.com/2481898"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481879"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481880"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481881"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481882"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481884"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481885"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481887"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481890"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481891"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481892"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481893"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481894"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481896"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481897"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34180"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34181"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34182"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34183"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42764"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42766"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42767"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42768"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42769"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42770"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45445"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45446"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45447"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7383"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9076"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-25239.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:25237"
},
{
"url": "https://github.com/openssl/openssl/commit/61a86a8cd73546c9fea916f3d304c1293e05c046"
},
{
"url": "https://github.com/openssl/openssl/commit/665d5254083affde9982efca7c41dd01cacc8774"
},
{
"url": "https://github.com/openssl/openssl/commit/810b722f772652ad48042bcc7ab07e3414b11d0f"
},
{
"url": "https://github.com/openssl/openssl/commit/b90ff3b1bd33b1c18e6a09936d097c2eddef8873"
},
{
"url": "https://github.com/openssl/openssl/commit/e6f912907fc2ec82a0fd07aae55172c5e5e3d90d"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42767"
},
{
"url": "https://openssl-library.org/news/secadv/20260609.txt"
},
{
"url": "https://ubuntu.com/security/notices/USN-8414-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42767"
}
],
"published": "2026-06-09T17:17:08+00:00",
"updated": "2026-06-16T02:58:39+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
}
},
{
"id": "CVE-2026-42768",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "low"
},
{
"source": {
"name": "redhat"
},
"score": 6.3,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
514
],
"description": "Issue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to\nBleichenbacher-style attack when an attacker is able to provide the CMS or\nS/MIME messages and observe the error code and/or decryption output.\n\nImpact summary: The Bleichenbacher-style attack allows an attacker to use the\nvictim's vulnerable application as a way to decrypt or sign messages with the\nvictim's private RSA key.\n\nThe attack is possible in 2 variants.\n\n1. The decryption API (CMS_decrypt(), PKCS7_decrypt()) is used without\nproviding the recipient certificate. In this case OpenSSL iterates over every\nKeyTransRecipientInfo (KTRI) without stopping at the first success.\n\nAn attacker who authors a message with two KTRI entries \u2014 the first one\nwrapping a real CEK under the victim's public key, the second with an\narbitrary probe ciphertext \u2014 obtains opportunity to iterate the 2nd KTRI to\nget a valid PKCS#1 v1.5 padding if the error code of the application is\navailable.\n\nThat is a Bleichenbacher oracle (Bleichenbacher, CRYPTO '98): an\nadaptive-chosen-ciphertext side channel from which the attacker decrypts any\nRSA ciphertext to the victim's key or forges any PKCS#1 v1.5 signature under\nit.\n\n2. When the decryption API (CMS_decrypt(), PKCS7_decrypt()) is provided with\nthe recipient certificate, and the recipient is not found, a random\nkey is substituted.\n\nAn attacker who authors a message and is able to compare both error code and\nthe result of the decryption, can mount a Bleichenbacher oracle.\n\nWe are not aware of any applications that provide a remote attacker\nan opportunity to mount an attack described in these scenarios. We consider\nthe existence of such application very unlikely, and for this reason this\nCVE has been evaluated as Low severity.\n\nTo avoid these attacks, when RSA PKCS#1 v1.5 Key Transport is in use, the\ninvoked EVP_PKEY_decrypt() will use the implicit rejection mechanism described\nin draft-irtf-cfrg-rsa-guidance. In previous OpenSSL releases the implicit\nrejection was explicitly disabled.\n\nThe implicit rejection mechanism always returns a plaintext value,\nthe symmetric key. This result is deterministic for the ciphertext and the\nprivate key. The length of the decryption result can happen to match the\nlength of the key of the symmetric cipher that was used for the content\nencryption. When a certificate is not provided, the last RecipientInfo\nproducing a key that looks valid will be used. It may cause getting garbage\ncontent on decryption. As a proper way to deal with this a recipient\ncertificate has to be provided to identify the particular RecipientInfo for\ndecryption.\n\nThe FIPS modules in 4.0, 3.6, 3.5, and 3.4 are not affected by this issue, as\nCMS and S/MIME processing happens outside the OpenSSL FIPS module boundary.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-42768"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:25239"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-42768"
},
{
"url": "https://bugzilla.redhat.com/2481879"
},
{
"url": "https://bugzilla.redhat.com/2481880"
},
{
"url": "https://bugzilla.redhat.com/2481881"
},
{
"url": "https://bugzilla.redhat.com/2481882"
},
{
"url": "https://bugzilla.redhat.com/2481884"
},
{
"url": "https://bugzilla.redhat.com/2481885"
},
{
"url": "https://bugzilla.redhat.com/2481887"
},
{
"url": "https://bugzilla.redhat.com/2481890"
},
{
"url": "https://bugzilla.redhat.com/2481891"
},
{
"url": "https://bugzilla.redhat.com/2481892"
},
{
"url": "https://bugzilla.redhat.com/2481893"
},
{
"url": "https://bugzilla.redhat.com/2481894"
},
{
"url": "https://bugzilla.redhat.com/2481896"
},
{
"url": "https://bugzilla.redhat.com/2481897"
},
{
"url": "https://bugzilla.redhat.com/2481898"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481879"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481880"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481881"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481882"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481884"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481885"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481887"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481890"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481891"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481892"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481893"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481894"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481896"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481897"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34180"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34181"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34182"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34183"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42764"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42766"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42767"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42768"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42769"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42770"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45445"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45446"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45447"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7383"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9076"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-25239.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:25237"
},
{
"url": "https://github.com/openssl/openssl/commit/a2ca7b2d73e0ffc1eae183fe6e1741dac767cb4f"
},
{
"url": "https://github.com/openssl/openssl/commit/bbb151a83041705d9d001ed2f9c12f5523e1b54d"
},
{
"url": "https://github.com/openssl/openssl/commit/dd68364107a58841c0a2546812518b65d3a23abd"
},
{
"url": "https://github.com/openssl/openssl/commit/f04b377be3d821741c86d1f4bf84dee09f3d5c3e"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42768"
},
{
"url": "https://openssl-library.org/news/secadv/20260609.txt"
},
{
"url": "https://ubuntu.com/security/notices/USN-8414-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42768"
}
],
"published": "2026-06-09T17:17:08+00:00",
"updated": "2026-06-16T02:58:12+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
}
},
{
"id": "CVE-2026-42769",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.9,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
295
],
"description": "Issue Summary: An error in the callback used to verify the certificate\nprovided in a Root CA key update Certificate Management Protocol (CMP)\nmessage response rendered the certificate validation ineffectual, which\ncould lead to escalation of credentials from the Registration Authority (RA)\nlevel to the root Certification Authority (root CA) level.\n\nImpact Summary: The Registration Autority could replace the root CA\ncertificate for the CMP clients with an arbitrary root CA certificate.\n\nOne of the parts of the Certificate Management Protocol (CMP), specified in\nRFC 9810, is Root Certification Authority (root CA) key Rollover,\nwhich is sent by the server in a message with type 'id-it-rootCaKeyUpdate'.\nAs part of these messages, 'newWithOld' certificate, the new root CA\ncertificate signed with the old root CA key, is provided, and verifying its\nsignature is crucial for transferring the trust from the old CA key to the\nnew one.\n\nThe 'id-it-rootCaKeyUpdate' messages are expected to be processed with\nOSSL_CMP_get1_rootCaKeyUpdate(), that is expected to verify the 'newWithOld'\ncertificate. A typo in the certificate chain building code led to adding\nan incorrect certificate ('newWithOld' instead of 'oldRoot') to the\ncertificate chain, rendering the certificate verification process ineffectual\n(only the issuer name and the algorithm OIDs were verified by other parts\nof the verification code).\n\nAn attacker who already has credentials that satisfy the CMP message\nprotection checks can generate a new key pair and use a crafted self-signed\ncertificate in its 'id-it-rootCaKeyUpdate' CMP messages which affected CMP\nclients would accept as a new trust anchor.\n\nSignificant preconditions for the attack (having valid RA-level credentials)\nare the reason the issue was assigned Low severity.\n\nThe FIPS modules are not affected by this issue, as the affected code is\noutside the OpenSSL FIPS module boundary.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-42769"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:25239"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-42769"
},
{
"url": "https://bugzilla.redhat.com/2481879"
},
{
"url": "https://bugzilla.redhat.com/2481880"
},
{
"url": "https://bugzilla.redhat.com/2481881"
},
{
"url": "https://bugzilla.redhat.com/2481882"
},
{
"url": "https://bugzilla.redhat.com/2481884"
},
{
"url": "https://bugzilla.redhat.com/2481885"
},
{
"url": "https://bugzilla.redhat.com/2481887"
},
{
"url": "https://bugzilla.redhat.com/2481890"
},
{
"url": "https://bugzilla.redhat.com/2481891"
},
{
"url": "https://bugzilla.redhat.com/2481892"
},
{
"url": "https://bugzilla.redhat.com/2481893"
},
{
"url": "https://bugzilla.redhat.com/2481894"
},
{
"url": "https://bugzilla.redhat.com/2481896"
},
{
"url": "https://bugzilla.redhat.com/2481897"
},
{
"url": "https://bugzilla.redhat.com/2481898"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481879"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481880"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481881"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481882"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481884"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481885"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481887"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481890"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481891"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481892"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481893"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481894"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481896"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481897"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34180"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34181"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34182"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34183"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42764"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42766"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42767"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42768"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42769"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42770"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45445"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45446"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45447"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7383"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9076"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-25239.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:25237"
},
{
"url": "https://github.com/openssl/openssl/commit/54d0989997e5fc26057009a9782c3441ce3842fb"
},
{
"url": "https://github.com/openssl/openssl/commit/777b363b16fcf2153bb3ded39dc3838713667c44"
},
{
"url": "https://github.com/openssl/openssl/commit/d35cd473a271bf3ce7bf3d32af53217fb83ae92c"
},
{
"url": "https://github.com/openssl/openssl/commit/d531f21c0fe99067a66fc0ff1161ef127f9cd70b"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42769"
},
{
"url": "https://openssl-library.org/news/secadv/20260609.txt"
},
{
"url": "https://ubuntu.com/security/notices/USN-8414-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42769"
}
],
"published": "2026-06-09T17:17:08+00:00",
"updated": "2026-06-15T18:26:34+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
}
},
{
"id": "CVE-2026-42770",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "low"
},
{
"source": {
"name": "redhat"
},
"score": 5.9,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
325
],
"description": "Issue summary: When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42)\npeer key, the peer key is not properly checked for the subgroup membership.\n\nImpact summary: A malicious peer which presents an X9.42 key carrying the\nvictim's p and g parameters, a forged q = r (a small prime factor of the\ncofactor (p\u22121)/q_local), and a public value Y of order r can recover the\nvictim's private key after a small number of key exchange attempts.\n\nWhen EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the\nsubgroup membership check Y^q \u2261 1 (mod p) is performed using the peer's\nown q parameter, not the local key's q. The peer's domain parameters are\nthen matched against the domain parameters of the private key, but the value\nof q is not compared.\n\nA malicious peer who presents an X9.42 key carrying the victim's p, g,\na forged q = r (a small prime factor of the cofactor), and a public\nvalue Y of order r passes all checks. The shared secret then takes only\nr distinct values, leaking priv mod r. Repeating for each small-prime\nfactor of the cofactor and combining via CRT recovers the full private\nkey (Lim\u2013Lee / small-subgroup-confinement attack).\n\nThe realistic attack surface is narrow: principally CMP deployments with\nlong-lived RA/CA DHX keys and bespoke enterprise or government applications\nusing X9.42 DHX static keys with interactive protocols and therefore this\nissue was assigned Low severity.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are affected by this\nissue.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-42770"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:25239"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-42770"
},
{
"url": "https://bugzilla.redhat.com/2481879"
},
{
"url": "https://bugzilla.redhat.com/2481880"
},
{
"url": "https://bugzilla.redhat.com/2481881"
},
{
"url": "https://bugzilla.redhat.com/2481882"
},
{
"url": "https://bugzilla.redhat.com/2481884"
},
{
"url": "https://bugzilla.redhat.com/2481885"
},
{
"url": "https://bugzilla.redhat.com/2481887"
},
{
"url": "https://bugzilla.redhat.com/2481890"
},
{
"url": "https://bugzilla.redhat.com/2481891"
},
{
"url": "https://bugzilla.redhat.com/2481892"
},
{
"url": "https://bugzilla.redhat.com/2481893"
},
{
"url": "https://bugzilla.redhat.com/2481894"
},
{
"url": "https://bugzilla.redhat.com/2481896"
},
{
"url": "https://bugzilla.redhat.com/2481897"
},
{
"url": "https://bugzilla.redhat.com/2481898"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481879"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481880"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481881"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481882"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481884"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481885"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481887"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481890"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481891"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481892"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481893"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481894"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481896"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481897"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34180"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34181"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34182"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34183"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42764"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42766"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42767"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42768"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42769"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42770"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45445"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45446"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45447"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7383"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9076"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-25239.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:25237"
},
{
"url": "https://github.com/openssl/openssl/commit/3da5a516cd2635a320ff748503db2cef7c4b0f02"
},
{
"url": "https://github.com/openssl/openssl/commit/3ddbb7ab50bd93dfc59cbe08e269a67605aeebdb"
},
{
"url": "https://github.com/openssl/openssl/commit/5f452bba2c681423d8fcffd120a19b757ee42e3c"
},
{
"url": "https://github.com/openssl/openssl/commit/7fbfde7677ed8808828bf00ff01c937ca04bdda2"
},
{
"url": "https://github.com/openssl/openssl/commit/ca2237ab5615641b662183b077f62c08d75e8070"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42770"
},
{
"url": "https://openssl-library.org/news/secadv/20260609.txt"
},
{
"url": "https://ubuntu.com/security/notices/USN-8414-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42770"
}
],
"published": "2026-06-09T17:17:08+00:00",
"updated": "2026-06-16T02:58:00+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
}
},
{
"id": "CVE-2026-42923",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "redhat"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
407
],
"description": "NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the DNSSEC validator where the code path to consult the negative cache for DS records does not take into account the limit on NSEC3 hash calculations introduced in 1.19.1. This leads to degradation of service during the attack. An adversary that controls a DNSSEC signed zone can exploit this by signing NSEC3 records with acceptably high iterations for child delegations and querying a vulnerable Unbound. Unbound will keep performing the allowed hash calculations on the NSEC3 records and will not limit the work by the mitigation introduced in 1.19.1. As a side effect, a global lock for the negative cache will be held for the duration of the hashing, blocking other threads that need to consult the negative cache. Coordinated attacks could raise the vulnerability to denial of service. Unbound 1.25.1 contains a patch with a fix to bound the vulnerable code path with the existing limit for NSEC3 hash calculations.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-42923"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-42923"
},
{
"url": "https://nlnetlabs.nl/news/2026/May/20/unbound-1.25.1-released/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42923"
},
{
"url": "https://ubuntu.com/security/notices/USN-8282-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42923"
},
{
"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42923.txt"
}
],
"published": "2026-05-20T10:16:27+00:00",
"updated": "2026-05-20T22:50:35+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.16.2-5.10.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.16.2-5.10.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-42944",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
197,
787
],
"description": "NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a vulnerability that results in heap overflow when encoding multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options in the reply packet. The relevant options ('nsid', 'answer-cookie', 'pad-responses' (default)) need to be enabled for the vulnerability to be exploited. An adversary who can query Unbound can exploit the vulnerability by attaching multiple NSID and/or DNS Cookie EDNS and/or EDNS Padding options to the query. A flaw in the size calculation of the EDNS field truncates the correct value which allows the encoder to overflow the available space when writing. Those two combined lead to a heap overflow write of Unbound controlled data and eventually a crash. Unbound 1.25.1 contains a patch with a fix to de-duplicate the EDNS options and a fix to prevent truncation of the EDNS field size calculation.",
"recommendation": "Upgrade python3-unbound to version 1.16.2-5.11.el8_10; Upgrade unbound-libs to version 1.16.2-5.11.el8_10",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-42944"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:24369"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-42944"
},
{
"url": "https://bugzilla.redhat.com/2479774"
},
{
"url": "https://bugzilla.redhat.com/2479806"
},
{
"url": "https://bugzilla.redhat.com/2479808"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479774"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479806"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479808"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33278"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42944"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42959"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-24369.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:24369"
},
{
"url": "https://linux.oracle.com/cve/CVE-2026-42944.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2026-24365.html"
},
{
"url": "https://nlnetlabs.nl/news/2026/May/20/unbound-1.25.1-released/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42944"
},
{
"url": "https://ubuntu.com/security/notices/USN-8282-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42944"
},
{
"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42944.txt"
}
],
"published": "2026-05-20T10:16:27+00:00",
"updated": "2026-05-20T22:50:49+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.16.2-5.10.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.16.2-5.10.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "in_triage",
"justification": "",
"response": [],
"detail": "This CVE is under investigation by Confluent."
}
},
{
"id": "CVE-2026-42959",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
824
],
"description": "NLnet Labs Unbound up to and including version 1.25.0 has a denial of service vulnerability in the DNSSEC validator that can lead to a crash given malicious upstream replies. When Unbound constructs chase-reply messages for validation, the code uses the wrong counter to calculate write offsets for ADDITIONAL section rrsets. DNAME duplication could increase the ANSWER section count and authority filtering could decrease the AUTHORITY section count and create an uninitialized array slot. Combining these two, the validator later dereferences this uninitialized pointer, causing an immediate process crash. An adversary controlling a DNSSEC-signed domain can trigger this bug with a single query by configuring a DNAME chain with unsigned CNAMEs and a response containing unsigned AUTHORITY records alongside signed ADDITIONAL glue records. Unbound 1.25.1 contains a patch with a fix to use the proper counters to calculate the write offsets.",
"recommendation": "Upgrade python3-unbound to version 1.16.2-5.11.el8_10; Upgrade unbound-libs to version 1.16.2-5.11.el8_10",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-42959"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:24369"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-42959"
},
{
"url": "https://bugzilla.redhat.com/2479774"
},
{
"url": "https://bugzilla.redhat.com/2479806"
},
{
"url": "https://bugzilla.redhat.com/2479808"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479774"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479806"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479808"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33278"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42944"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42959"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-24369.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:24369"
},
{
"url": "https://linux.oracle.com/cve/CVE-2026-42959.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2026-24365.html"
},
{
"url": "https://nlnetlabs.nl/news/2026/May/20/unbound-1.25.1-released/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42959"
},
{
"url": "https://ubuntu.com/security/notices/USN-8282-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8282-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42959"
},
{
"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42959.txt"
}
],
"published": "2026-05-20T10:16:27+00:00",
"updated": "2026-05-20T22:51:00+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.16.2-5.10.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.16.2-5.10.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "in_triage",
"justification": "",
"response": [],
"detail": "This CVE is under investigation by Confluent."
}
},
{
"id": "CVE-2026-42960",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 10,
"severity": "critical",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "critical"
},
{
"source": {
"name": "redhat"
},
"score": 5.9,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
349
],
"description": "NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records for the authority section. Promiscuous RRSets that complement DNS replies in the authority section can be used to trick Unbound to cache such records. If an adversary is able to attach such records in a reply (i.e., spoofed packet, fragmentation attack) he would be able to poison Unbound's cache. A malicious actor can exploit the possible poisonous effect by injecting RRSets other than NS that are also accompanied by address records in a reply, for example MX. This could be achieved by trying to spoof a reply packet or fragmentation attacks. Unbound would then accept the relative address records in the additional section and cache them if the authority RRSet has enough trust at this point, i.e., in-zone data for the delegation point. Unbound 1.25.1 contains a patch with a fix that disregards address records from the additional section if they are not explicitly relevant only to authority NS records, mitigating the possible poison effect. This is a complement fix to CVE-2025-11411.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-42960"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-42960"
},
{
"url": "https://nlnetlabs.nl/news/2026/May/20/unbound-1.25.1-released/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42960"
},
{
"url": "https://ubuntu.com/security/notices/USN-8282-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8282-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42960"
},
{
"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-42960.txt"
}
],
"published": "2026-05-20T10:16:28+00:00",
"updated": "2026-05-20T22:51:43+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.16.2-5.10.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.16.2-5.10.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-4426",
"ratings": [
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
1335
],
"description": "A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field (`pz_log2_bs`) read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect memory allocation and potential application crashes, resulting in a denial-of-service (DoS) condition.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-4426"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:8944"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-4426"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449010"
},
{
"url": "https://github.com/libarchive/libarchive/pull/2897"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4426"
},
{
"url": "https://ubuntu.com/security/notices/USN-8292-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4426"
}
],
"published": "2026-03-19T15:16:28+00:00",
"updated": "2026-05-03T21:16:11+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.3.3-7.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-4437",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
},
{
"source": {
"name": "rocky"
},
"severity": "medium"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
125
],
"description": "Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-4437"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:19061"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-4437"
},
{
"url": "https://bugzilla.redhat.com/2449777"
},
{
"url": "https://bugzilla.redhat.com/2449783"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449777"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449783"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453117"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4046"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4437"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4438"
},
{
"url": "https://errata.almalinux.org/10/ALSA-2026-19061.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:20597"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4437"
},
{
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34014"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4437"
},
{
"url": "https://www.openwall.com/lists/oss-security/2026/03/23/2"
}
],
"published": "2026-03-20T20:16:49+00:00",
"updated": "2026-04-07T18:41:36+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.28-251.el8_10.37",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.28-251.el8_10.37",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.28-251.el8_10.37",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-4438",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 4,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
{
"source": {
"name": "rocky"
},
"severity": "medium"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
20,
88
],
"description": "Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-4438"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:19061"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-4438"
},
{
"url": "https://bugzilla.redhat.com/2449777"
},
{
"url": "https://bugzilla.redhat.com/2449783"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449777"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449783"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453117"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4046"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4437"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4438"
},
{
"url": "https://errata.almalinux.org/10/ALSA-2026-19061.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:20597"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4438"
},
{
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34015"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4438"
},
{
"url": "https://www.openwall.com/lists/oss-security/2026/03/23/2"
}
],
"published": "2026-03-20T20:16:49+00:00",
"updated": "2026-04-07T18:40:02+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.28-251.el8_10.37",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.28-251.el8_10.37",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.28-251.el8_10.37",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-44431",
"source": {
"name": "ghsa",
"url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip"
},
"ratings": [
{
"source": {
"name": "azure"
},
"severity": "high"
},
{
"source": {
"name": "ghsa"
},
"score": 5.3,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
},
{
"source": {
"name": "nvd"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
},
{
"source": {
"name": "redhat"
},
"score": 5.9,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
200
],
"description": "urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.",
"recommendation": "Upgrade urllib3 to version 2.7.0",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-44431"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-44431"
},
{
"url": "https://github.com/urllib3/urllib3"
},
{
"url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44431"
},
{
"url": "https://ubuntu.com/security/notices/USN-8379-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44431"
}
],
"published": "2026-05-13T16:16:57+00:00",
"updated": "2026-05-14T13:56:27+00:00",
"affects": [
{
"ref": "pkg:pypi/urllib3@2.6.3",
"versions": [
{
"version": "2.6.3",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:pypi/urllib3@2.6.3"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:pypi/urllib3@2.6.3"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:pypi/urllib3@2.6.3"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:pypi/urllib3@2.6.3"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:pypi/urllib3@2.6.3"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:pypi/urllib3@2.6.3"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:pypi/urllib3@2.6.3"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:pypi/urllib3@2.6.3"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:pypi/urllib3@2.6.3"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:pypi/urllib3@2.6.3"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:pypi/urllib3@2.6.3"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:pypi/urllib3@2.6.3"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:pypi/urllib3@2.6.3"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:pypi/urllib3@2.6.3"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:pypi/urllib3@2.6.3"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:pypi/urllib3@2.6.3"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:pypi/urllib3@2.6.3"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:pypi/urllib3@2.6.3"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:pypi/urllib3@2.6.3"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-44432",
"source": {
"name": "ghsa",
"url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip"
},
"ratings": [
{
"source": {
"name": "ghsa"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
409
],
"description": "urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Brotli library or (2) when HTTPResponse.drain_conn() was called after the response had been read and decompressed partially (compression algorithm did not matter here). These issues could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This could result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data) on the client side. This vulnerability is fixed in 2.7.0.",
"recommendation": "Upgrade urllib3 to version 2.7.0",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-44432"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-44432"
},
{
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2026-142.yaml"
},
{
"url": "https://github.com/urllib3/urllib3"
},
{
"url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432"
},
{
"url": "https://ubuntu.com/security/notices/USN-8379-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44432"
}
],
"published": "2026-05-13T16:16:57+00:00",
"updated": "2026-05-14T13:49:25+00:00",
"affects": [
{
"ref": "pkg:pypi/urllib3@2.6.3",
"versions": [
{
"version": "2.6.3",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:pypi/urllib3@2.6.3"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:pypi/urllib3@2.6.3"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:pypi/urllib3@2.6.3"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:pypi/urllib3@2.6.3"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:pypi/urllib3@2.6.3"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:pypi/urllib3@2.6.3"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:pypi/urllib3@2.6.3"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:pypi/urllib3@2.6.3"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:pypi/urllib3@2.6.3"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:pypi/urllib3@2.6.3"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:pypi/urllib3@2.6.3"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:pypi/urllib3@2.6.3"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:pypi/urllib3@2.6.3"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:pypi/urllib3@2.6.3"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:pypi/urllib3@2.6.3"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:pypi/urllib3@2.6.3"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:pypi/urllib3@2.6.3"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:pypi/urllib3@2.6.3"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:pypi/urllib3@2.6.3"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-44604",
"ratings": [
{
"source": {
"name": "redhat"
},
"score": 7,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"cwes": [
78
],
"description": "A command injection vulnerability was discovered in the `rpmuncompress` utility of RPM. When extracting certain archive formats (ZIP, 7z, GEM) to a specified destination directory, the tool inserts the archive's top-level folder name into a shell command without properly sanitizing it. A specially crafted archive containing shell metacharacters in its folder name can execute arbitrary commands as the user running the extraction.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-44604"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-44604"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460967"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44604"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44604"
}
],
"published": "2026-05-28T08:16:35+00:00",
"updated": "2026-05-28T13:44:54+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/python3-rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "4.14.3-32.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/rpm-build-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "4.14.3-32.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/rpm-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "4.14.3-32.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "4.14.3-32.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/python3-rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/rpm-build-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/rpm-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/python3-rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/rpm-build-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/rpm-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/python3-rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/rpm-build-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/rpm-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/python3-rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/rpm-build-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/rpm-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/python3-rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/rpm-build-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/rpm-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/python3-rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/rpm-build-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/rpm-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/python3-rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/rpm-build-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/rpm-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/python3-rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/rpm-build-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/rpm-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/python3-rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/rpm-build-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/rpm-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/python3-rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/rpm-build-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/rpm-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/python3-rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/rpm-build-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/rpm-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/python3-rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/rpm-build-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/rpm-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/python3-rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/rpm-build-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/rpm-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/python3-rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/rpm-build-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/rpm-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/python3-rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/rpm-build-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/rpm-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/python3-rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/rpm-build-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/rpm-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/python3-rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/rpm-build-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/rpm-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/python3-rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/rpm-build-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/rpm-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/python3-rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/rpm-build-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/rpm-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/python3-rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/rpm-build-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/rpm-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/python3-rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/rpm-build-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/rpm-libs@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/rpm@4.14.3-32.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "in_triage",
"justification": "",
"response": [],
"detail": "This CVE is under investigation by Confluent."
}
},
{
"id": "CVE-2026-44608",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 5.9,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 5.9,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
413
],
"description": "NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a locking inconsistency vulnerability that when certain conditions are met (multi-threaded, RPZ XFR reload, RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers) it could result in heap use-after-free and eventual crash. An adversary can exploit the vulnerability if conditions are first met on a vulnerable Unbound, i.e., multi-threaded, an RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers and an ongoing XFR for that RPZ zone. Local RPZ files do not trigger the vulnerability. If the timing is right and an XFR happens at the same time another thread needs to read that RPZ zone, the reader may not hold the lock long enough and the thread applying the XFR may free objects that the reader is about to walk causing the use-after-free. Unbound 1.25.1 contains a patch with a fix to the locking code.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-44608"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-44608"
},
{
"url": "https://nlnetlabs.nl/news/2026/May/20/unbound-1.25.1-released/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44608"
},
{
"url": "https://ubuntu.com/security/notices/USN-8282-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44608"
},
{
"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-44608.txt"
}
],
"published": "2026-05-20T10:16:28+00:00",
"updated": "2026-05-20T22:52:48+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.16.2-5.10.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.16.2-5.10.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.10.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-45446",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 3.7,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
325
],
"description": "Issue summary: The implementations of AES-SIV (RFC 5297) and AES-GCM-SIV\n(RFC 8452) mishandle the authentication of AAD (Additional Authenticated\nData) with an empty ciphertext allowing a forgery of such messages.\n\nImpact summary: An attacker can forge empty messages with arbitrary AAD\nto the victim's application using these ciphers.\n\nAES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) are nonce-misuse-resistant AEAD\nmodes: they accept a key, nonce, optional AAD (bytes that are authenticated\nbut not encrypted), and plaintext, and produces ciphertext plus a 16-byte\ntag. On decrypt, `EVP_DecryptFinal_ex()` is documented to return success only\nif the tag is verified succesfully.\n\nIn OpenSSL's provider implementation of these ciphers, the expected tag is\ncomputed only when decryption function is invoked with non-empty data.\nIf the caller supplies AAD and then calls `EVP_DecryptFinal_ex()` without\ninvocation of the ciphertext update, which can happen when the received\nciphertext length is zero, the tag is never recalculated and still holds its\nall-zeros value.\n\nWhen AES-GCM-SIV is used, an attacker who sends arbitrary AAD, empty\nciphertext, and all-zeros tag passes authentication under any key they do not\nknow, single-shot. When AES-SIV is used, for mounting the attack it's\nnecessary for the application to reuse the decryption context without\nresetting the key.\n\nAES-SIV is implemented since OpenSSL 3.0. AES-GCM-SIV is implemented since\nOpenSSL 3.2.\n\nNo protocols implemented in OpenSSL itself (TLS/CMS/PKCS7/HPKE/QUIC) support\neither AES-GCM-SIV or AES-SIV. To mount an attack, the applications must\nimplement their own protocol and use the EVP interface. Also they must skip the\nciphertext update when a message with an empty ciphertext arrives.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as these algorithms are not FIPS approved and the affected code is\noutside the OpenSSL FIPS module boundary.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-45446"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:25239"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-45446"
},
{
"url": "https://bugzilla.redhat.com/2481879"
},
{
"url": "https://bugzilla.redhat.com/2481880"
},
{
"url": "https://bugzilla.redhat.com/2481881"
},
{
"url": "https://bugzilla.redhat.com/2481882"
},
{
"url": "https://bugzilla.redhat.com/2481884"
},
{
"url": "https://bugzilla.redhat.com/2481885"
},
{
"url": "https://bugzilla.redhat.com/2481887"
},
{
"url": "https://bugzilla.redhat.com/2481890"
},
{
"url": "https://bugzilla.redhat.com/2481891"
},
{
"url": "https://bugzilla.redhat.com/2481892"
},
{
"url": "https://bugzilla.redhat.com/2481893"
},
{
"url": "https://bugzilla.redhat.com/2481894"
},
{
"url": "https://bugzilla.redhat.com/2481896"
},
{
"url": "https://bugzilla.redhat.com/2481897"
},
{
"url": "https://bugzilla.redhat.com/2481898"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481879"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481880"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481881"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481882"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481884"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481885"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481887"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481890"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481891"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481892"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481893"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481894"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481896"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481897"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34180"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34181"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34182"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34183"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42764"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42766"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42767"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42768"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42769"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42770"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45445"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45446"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45447"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7383"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9076"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-25239.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:25237"
},
{
"url": "https://github.com/openssl/openssl/commit/25b32cd9d41d2bc01b6abc425bb4baf2c2236fdc"
},
{
"url": "https://github.com/openssl/openssl/commit/71e2a5d263518cf5866043bd60ee4994d59e53a3"
},
{
"url": "https://github.com/openssl/openssl/commit/7fe3f33a3b3a4c487aa4dcdbc87057f66ffd2b85"
},
{
"url": "https://github.com/openssl/openssl/commit/daca0f48e4a69a2892a62262bad59e62a8a76598"
},
{
"url": "https://github.com/openssl/openssl/commit/eec5e9bf0d867333b8495e456f5235d225798a68"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45446"
},
{
"url": "https://openssl-library.org/news/secadv/20260609.txt"
},
{
"url": "https://ubuntu.com/security/notices/USN-8414-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45446"
}
],
"published": "2026-06-09T17:17:19+00:00",
"updated": "2026-06-16T02:57:01+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
}
},
{
"id": "CVE-2026-45447",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 8.1,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
},
{
"source": {
"name": "ubuntu"
},
"severity": "high"
}
],
"cwes": [
416
],
"description": "Issue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.",
"recommendation": "Upgrade openssl to version 1:1.1.1k-16.el8_6; Upgrade openssl-libs to version 1:1.1.1k-16.el8_6",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-45447"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:25239"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-45447"
},
{
"url": "https://bugzilla.redhat.com/2481879"
},
{
"url": "https://bugzilla.redhat.com/2481880"
},
{
"url": "https://bugzilla.redhat.com/2481881"
},
{
"url": "https://bugzilla.redhat.com/2481882"
},
{
"url": "https://bugzilla.redhat.com/2481884"
},
{
"url": "https://bugzilla.redhat.com/2481885"
},
{
"url": "https://bugzilla.redhat.com/2481887"
},
{
"url": "https://bugzilla.redhat.com/2481890"
},
{
"url": "https://bugzilla.redhat.com/2481891"
},
{
"url": "https://bugzilla.redhat.com/2481892"
},
{
"url": "https://bugzilla.redhat.com/2481893"
},
{
"url": "https://bugzilla.redhat.com/2481894"
},
{
"url": "https://bugzilla.redhat.com/2481896"
},
{
"url": "https://bugzilla.redhat.com/2481897"
},
{
"url": "https://bugzilla.redhat.com/2481898"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481879"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481880"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481881"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481882"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481884"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481885"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481887"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481890"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481891"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481892"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481893"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481894"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481896"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481897"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34180"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34181"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34182"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34183"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42764"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42766"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42767"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42768"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42769"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42770"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45445"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45446"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45447"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7383"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9076"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-25239.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:25237"
},
{
"url": "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c"
},
{
"url": "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8"
},
{
"url": "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54"
},
{
"url": "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c"
},
{
"url": "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e"
},
{
"url": "https://linux.oracle.com/cve/CVE-2026-45447.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2026-26275.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45447"
},
{
"url": "https://openssl-library.org/news/secadv/20260609.txt"
},
{
"url": "https://ubuntu.com/security/notices/USN-8414-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8414-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45447"
}
],
"published": "2026-06-09T17:17:19+00:00",
"updated": "2026-06-16T02:56:50+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "in_triage",
"justification": "",
"response": [],
"detail": "This CVE is under investigation by Confluent."
}
},
{
"id": "CVE-2026-4873",
"ratings": [
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
295,
319
],
"description": "A vulnerability exists where a connection requiring TLS incorrectly reuses an\nexisting unencrypted connection from the same connection pool. If an initial\ntransfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request\nto that same host bypasses the TLS requirement and instead transmit data\nunencrypted.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-4873"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/04/29/7"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-4873"
},
{
"url": "https://curl.se/docs/CVE-2026-4873.html"
},
{
"url": "https://curl.se/docs/CVE-2026-4873.json"
},
{
"url": "https://hackerone.com/reports/3621851"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4873"
},
{
"url": "https://ubuntu.com/security/notices/USN-8227-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4873"
}
],
"published": "2026-05-13T13:01:55+00:00",
"updated": "2026-05-14T13:45:11+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.11",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.11",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-48864",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 7.8,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"cwes": [
787
],
"description": "A flaw was found in libsolv. This heap buffer overflow occurs during the decompression of attacker-controlled compressed data within `.solv` files due to insufficient input validation. An attacker can provide a specially crafted `.solv` file, which, when processed by a vulnerable application, can lead to out-of-bounds memory access. This could result in information disclosure, alteration of program execution, or a denial of service.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-48864"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:21333"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-48864"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460425"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48864"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-48864"
}
],
"published": "2026-05-26T17:16:54+00:00",
"updated": "2026-05-28T19:22:42+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "0.7.20-6.el8",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "in_triage",
"justification": "",
"response": [],
"detail": "This CVE is under investigation by Confluent."
}
},
{
"id": "CVE-2026-50219",
"ratings": [
{
"source": {
"name": "nvd"
},
"score": 5.9,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"source": {
"name": "redhat"
},
"score": 4.9,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
}
],
"cwes": [
416
],
"description": "libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur,",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-50219"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-50219"
},
{
"url": "https://github.com/libexpat/libexpat/pull/1246"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50219"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50219"
}
],
"published": "2026-06-04T06:16:25+00:00",
"updated": "2026-06-04T18:39:29+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.5.0-2.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/expat@2.5.0-2.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-5419",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "redhat"
},
"score": 3.7,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
208
],
"description": "A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote attacker to potentially leak sensitive information about the padding bytes through observable timing differences. This vulnerability is a form of information disclosure.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-5419"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:20612"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:20613"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-5419"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445762"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445763"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450624"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450625"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467279"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467289"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467437"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467441"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467448"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467450"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467451"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467678"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467686"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33845"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33846"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3832"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3833"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42009"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42010"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42011"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42012"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42013"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42014"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42015"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5260"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5419"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:20612"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5419"
},
{
"url": "https://ubuntu.com/security/notices/USN-8284-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5419"
},
{
"url": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-13"
}
],
"published": "2026-06-01T21:16:47+00:00",
"updated": "2026-06-02T17:16:37+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.16-8.el8_10.6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.6?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-5435",
"ratings": [
{
"source": {
"name": "redhat"
},
"score": 5.9,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
787
],
"description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-5435"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-5435"
},
{
"url": "https://inbox.sourceware.org/libc-alpha/cover.1777546194.git.fweimer@redhat.com/"
},
{
"url": "https://inbox.sourceware.org/libc-announce/7a655d55-276f-41fe-b550-feb3ebb2ce91@redhat.com/T/#u"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5435"
},
{
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34033"
},
{
"url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0011"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5435"
}
],
"published": "2026-04-28T13:19:22+00:00",
"updated": "2026-05-05T17:38:37+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.28-251.el8_10.37",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.28-251.el8_10.37",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.28-251.el8_10.37",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-54411",
"ratings": [
{
"source": {
"name": "redhat"
},
"score": 4.8,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"cwes": [
208
],
"description": "Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences. The comparison uses strncmp() (or strncasecmp() when PAM_ICASE_ARG is set) preceded by a length-equality check, so the time to reject a candidate depends on the index of the first differing byte and on whether the candidate's length matches the stored password, leaking the password length and individual prefix bytes. The vulnerable path is reached when the administrator configures pam_userdb with crypt=none, with an unrecognized crypt method, or without a crypt= argument, causing the module to store and compare credentials in plaintext.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-54411"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-54411"
},
{
"url": "https://cwe.mitre.org/data/definitions/208.html"
},
{
"url": "https://github.com/linux-pam/linux-pam"
},
{
"url": "https://github.com/linux-pam/linux-pam/blob/master/libpam/include/pam_inline.h"
},
{
"url": "https://github.com/linux-pam/linux-pam/blob/master/modules/pam_userdb/pam_userdb.c#L327"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54411"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54411"
}
],
"published": "2026-06-14T18:17:20+00:00",
"updated": "2026-06-16T15:36:43+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/pam@1.3.1-39.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.3.1-39.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/pam@1.3.1-39.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/pam@1.3.1-39.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/pam@1.3.1-39.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/pam@1.3.1-39.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/pam@1.3.1-39.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/pam@1.3.1-39.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/pam@1.3.1-39.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/pam@1.3.1-39.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/pam@1.3.1-39.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/pam@1.3.1-39.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/pam@1.3.1-39.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/pam@1.3.1-39.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/pam@1.3.1-39.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/pam@1.3.1-39.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/pam@1.3.1-39.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/pam@1.3.1-39.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/pam@1.3.1-39.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/pam@1.3.1-39.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/pam@1.3.1-39.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/pam@1.3.1-39.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/pam@1.3.1-39.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-5450",
"ratings": [
{
"source": {
"name": "photon"
},
"severity": "critical"
},
{
"source": {
"name": "redhat"
},
"score": 5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:H"
}
],
"cwes": [
122,
787
],
"description": "Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-5450"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-5450"
},
{
"url": "https://inbox.sourceware.org/libc-announce/b11f0003-6ec1-4bd6-b9de-9e38a4efeca3@redhat.com/T/#u"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5450"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5450#range-21286997"
},
{
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=CVE-2026-5450"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5450"
}
],
"published": "2026-04-20T21:16:36+00:00",
"updated": "2026-04-23T15:33:34+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.28-251.el8_10.37",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.28-251.el8_10.37",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.28-251.el8_10.37",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-5545",
"ratings": [
{
"source": {
"name": "nvd"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
613
],
"description": "libcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1's and user2's credentials when it is in fact\nstill using the connection authenticated for user1...",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-5545"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-5545"
},
{
"url": "https://curl.se/docs/CVE-2026-5545.html"
},
{
"url": "https://curl.se/docs/CVE-2026-5545.json"
},
{
"url": "https://hackerone.com/reports/3642555"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5545"
},
{
"url": "https://ubuntu.com/security/notices/USN-8227-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5545"
}
],
"published": "2026-05-13T13:01:56+00:00",
"updated": "2026-05-13T19:31:07+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.11",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.11",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-5704",
"ratings": [
{
"source": {
"name": "nvd"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
},
{
"source": {
"name": "redhat"
},
"score": 5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N"
}
],
"cwes": [
434
],
"description": "A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-5704"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/04/11/10"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/04/11/11"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/04/12/2"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-5704"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455360"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5704"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5704"
}
],
"published": "2026-04-06T16:16:42+00:00",
"updated": "2026-04-22T20:08:59+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2",
"versions": [
{
"version": "2:1.30-11.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-5713",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 6,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
}
],
"cwes": [
121,
125
],
"description": "The \"profiling.sampling\" module (Python 3.15+) and \"asyncio introspection capabilities\" (3.14+, \"python -m asyncio ps\" and \"python -m asyncio pstree\") features could be used to read and write addresses in a privileged process if that process connected to a malicious or \"infected\" Python process via the remote debugging feature. This vulnerability requires persistently and repeatedly connecting to the process to be exploited, even after the connecting process crashes with high likelihood due to ASLR.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-5713"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/04/15/6"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:19176"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-5713"
},
{
"url": "https://bugzilla.redhat.com/2431367"
},
{
"url": "https://bugzilla.redhat.com/2444691"
},
{
"url": "https://bugzilla.redhat.com/2448168"
},
{
"url": "https://bugzilla.redhat.com/2448181"
},
{
"url": "https://bugzilla.redhat.com/2449649"
},
{
"url": "https://bugzilla.redhat.com/2457409"
},
{
"url": "https://bugzilla.redhat.com/2457932"
},
{
"url": "https://bugzilla.redhat.com/2458049"
},
{
"url": "https://bugzilla.redhat.com/2458239"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431367"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444691"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448168"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448181"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449649"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457409"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457932"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458049"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458239"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0865"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1502"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2297"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3644"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4224"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4519"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4786"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5713"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6100"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-19176.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:19176"
},
{
"url": "https://github.com/python/cpython/commit/289fd2c97a7e5aecb8b69f94f5e838ccfeee7e67"
},
{
"url": "https://github.com/python/cpython/commit/316f6265b7f9ca4ffed5346b747475ef1943f35d"
},
{
"url": "https://github.com/python/cpython/issues/148178"
},
{
"url": "https://github.com/python/cpython/pull/148187"
},
{
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/OG4RHARYSNIE22GGOMVMCRH76L5HKPLM/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5713"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5713"
}
],
"published": "2026-04-14T16:16:48+00:00",
"updated": "2026-06-10T19:16:37+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-76.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-76.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-5745",
"ratings": [
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
476
],
"description": "A flaw was found in libarchive. A NULL pointer dereference vulnerability exists in the ACL parsing logic, specifically within the archive_acl_from_text_nl() function. When processing a malformed ACL string (such as a bare \"d\" or \"default\" tag without subsequent fields), the function fails to perform adequate validation before advancing the pointer. An attacker can exploit this by providing a maliciously crafted archive, causing an application utilizing the libarchive API (such as bsdtar) to crash, resulting in a Denial of Service (DoS).",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-5745"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:8944"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-5745"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455921"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5745"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5745"
}
],
"published": "2026-04-07T16:16:32+00:00",
"updated": "2026-05-03T15:15:58+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.3.3-7.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libarchive@3.3.3-7.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-5773",
"ratings": [
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
918
],
"description": "libcurl might in some circumstances reuse the wrong connection for SMB(S)\ntransfers.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a network transfer operation that was requested by an\napplication could wrongfully reuse an existing SMB connection to the same\nserver that was using a different 'share' than the new subsequent transfer\nshould.\n\nThis could in unlucky situations lead to the download of the wrong file or the\nupload of a file to the wrong place. When this happens, the same credentials\nare used and the server name is the same.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-5773"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/04/29/9"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-5773"
},
{
"url": "https://curl.se/docs/CVE-2026-5773.html"
},
{
"url": "https://curl.se/docs/CVE-2026-5773.json"
},
{
"url": "https://hackerone.com/reports/3650689"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5773"
},
{
"url": "https://ubuntu.com/security/notices/USN-8227-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5773"
}
],
"published": "2026-05-13T13:01:56+00:00",
"updated": "2026-05-13T19:13:14+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.11",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.11",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-5928",
"ratings": [
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:H"
}
],
"cwes": [
127
],
"description": "Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash.\n\nA bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-5928"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-5928"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5928"
},
{
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33998"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5928"
}
],
"published": "2026-04-20T21:16:36+00:00",
"updated": "2026-04-23T15:33:43+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.28-251.el8_10.37",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.28-251.el8_10.37",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.28-251.el8_10.37",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-5958",
"ratings": [
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "redhat"
},
"score": 6.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
367
],
"description": "When sed is invoked with both -i (in-place edit) and --follow-symlinks, the function open_next_file() performs two separate, non-atomic filesystem operations on the same path: \n1. resolves symlink to its target and stores\u00a0the resolved path for determining when output is written,\n2. opens the original symlink path\u00a0(not the resolved one) to read the file. \nBetween these two calls there is a race window. If an attacker atomically replaces the symlink with a different target during that window, sed will: read content from the new (attacker-chosen) symlink target and write the processed result to the path recorded in step 1.\u00a0This can lead to arbitrary file overwrite with attacker-controlled content in the context of the sed process.\n\n\nThis issue was fixed in version 4.10.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-5958"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/05/13/1"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-5958"
},
{
"url": "https://cert.pl/en/posts/2026/04/CVE-2026-5958"
},
{
"url": "https://github.com/advisories/GHSA-9r7w-j29g-xqx8"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5958"
},
{
"url": "https://ubuntu.com/security/notices/USN-8229-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8229-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5958"
},
{
"url": "https://www.gnu.org/software/sed"
},
{
"url": "https://www.gnu.org/software/sed/"
}
],
"published": "2026-04-20T12:16:08+00:00",
"updated": "2026-05-19T15:17:37+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/sed@4.5-5.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "4.5-5.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/sed@4.5-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/sed@4.5-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/sed@4.5-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/sed@4.5-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/sed@4.5-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/sed@4.5-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/sed@4.5-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/sed@4.5-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/sed@4.5-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/sed@4.5-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/sed@4.5-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/sed@4.5-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/sed@4.5-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/sed@4.5-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/sed@4.5-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/sed@4.5-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/sed@4.5-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/sed@4.5-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/sed@4.5-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/sed@4.5-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/sed@4.5-5.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-6019",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 6.1,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 6.8,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"
}
],
"cwes": [
150,
116
],
"description": "http.cookies.Morsel.js_output() returns an inline inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-6019"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-6019"
},
{
"url": "https://github.com/python/cpython/commit/3c59b8b53fc75c7f9578d16fb8201ceb43e8f76c"
},
{
"url": "https://github.com/python/cpython/commit/76b3923d688c0efc580658476c5f525ec8735104"
},
{
"url": "https://github.com/python/cpython/commit/f795e042043dfe26c42e1971d4502c1cdc4c65b8"
},
{
"url": "https://github.com/python/cpython/issues/90309"
},
{
"url": "https://github.com/python/cpython/pull/148848"
},
{
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/IVNWGV2BBNC3RHQAFS22UP4DY56SAXX3/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6019"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6019"
}
],
"published": "2026-04-22T20:16:42+00:00",
"updated": "2026-05-28T19:15:28+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-76.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-76.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-6238",
"ratings": [
{
"source": {
"name": "redhat"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
126
],
"description": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to validate the RDATA content against the RDATA length in a DNS response when processing LOC, CERT, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory.\n\nThese functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-6238"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-6238"
},
{
"url": "https://inbox.sourceware.org/libc-alpha/cover.1777546194.git.fweimer@redhat.com/"
},
{
"url": "https://inbox.sourceware.org/libc-announce/7a655d55-276f-41fe-b550-feb3ebb2ce91@redhat.com/T/#u"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6238"
},
{
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34069"
},
{
"url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0012"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6238"
}
],
"published": "2026-04-28T19:37:47+00:00",
"updated": "2026-05-04T17:57:24+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.28-251.el8_10.37",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.28-251.el8_10.37",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.28-251.el8_10.37",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.37?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-6253",
"ratings": [
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
522
],
"description": "curl might erroneously pass on credentials for a first proxy to a second\nproxy.\n\nThis can happen when the following conditions are true:\n\n1. curl is setup to use specific different proxies for different URL schemes\n2. the first proxy needs credentials\n3. the second proxy uses no credentials\n4. while using the first proxy (using say `http://`), curl is asked to follow\n a redirect to a URL using another scheme (say `https://`), accessed using a\n second, different, proxy",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-6253"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/04/29/11"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-6253"
},
{
"url": "https://curl.se/docs/CVE-2026-6253.html"
},
{
"url": "https://curl.se/docs/CVE-2026-6253.json"
},
{
"url": "https://hackerone.com/reports/3669637"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6253"
},
{
"url": "https://ubuntu.com/security/notices/USN-8227-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6253"
}
],
"published": "2026-05-13T13:01:56+00:00",
"updated": "2026-05-14T13:40:53+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.11",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.11",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-6276",
"ratings": [
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 3.7,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
319
],
"description": "Using libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-6276"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/04/29/13"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-6276"
},
{
"url": "https://curl.se/docs/CVE-2026-6276.html"
},
{
"url": "https://curl.se/docs/CVE-2026-6276.json"
},
{
"url": "https://hackerone.com/reports/3671818"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6276"
},
{
"url": "https://ubuntu.com/security/notices/USN-8227-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6276"
}
],
"published": "2026-05-13T13:01:56+00:00",
"updated": "2026-05-14T14:21:06+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.11",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.11",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-6357",
"source": {
"name": "ghsa",
"url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip"
},
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.8,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N"
}
],
"cwes": [
829
],
"description": "pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update functionality to run before wheels are installed to prevent newly-installed modules from being imported shortly after the installation of a wheel package. Users should still review package contents prior to installation.",
"recommendation": "Upgrade pip to version 26.1",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-6357"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/04/27/7"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-6357"
},
{
"url": "https://github.com/pypa/pip"
},
{
"url": "https://github.com/pypa/pip/commit/b369bfc96cc524e00c267e1693290e6599c36bad"
},
{
"url": "https://github.com/pypa/pip/pull/13923"
},
{
"url": "https://ichard26.github.io/blog/2026/04/whats-new-in-pip-26.1/#security-fixes"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6357"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6357"
}
],
"published": "2026-04-27T15:16:20+00:00",
"updated": "2026-04-27T23:16:03+00:00",
"affects": [
{
"ref": "pkg:pypi/pip@26.0.1",
"versions": [
{
"version": "26.0.1",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:pypi/pip@26.0.1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:pypi/pip@26.0.1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:pypi/pip@26.0.1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:pypi/pip@26.0.1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:pypi/pip@26.0.1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:pypi/pip@26.0.1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:pypi/pip@26.0.1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:pypi/pip@26.0.1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:pypi/pip@26.0.1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:pypi/pip@26.0.1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:pypi/pip@26.0.1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:pypi/pip@26.0.1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:pypi/pip@26.0.1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:pypi/pip@26.0.1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:pypi/pip@26.0.1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:pypi/pip@26.0.1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:pypi/pip@26.0.1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:pypi/pip@26.0.1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:pypi/pip@26.0.1"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-6429",
"ratings": [
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"description": "When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, libcurl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-6429"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-6429"
},
{
"url": "https://curl.se/docs/CVE-2026-6429.html"
},
{
"url": "https://curl.se/docs/CVE-2026-6429.json"
},
{
"url": "https://hackerone.com/reports/3677759"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6429"
},
{
"url": "https://ubuntu.com/security/notices/USN-8227-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6429"
}
],
"published": "2026-05-13T13:01:56+00:00",
"updated": "2026-05-14T14:18:02+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.11",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.11",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-6732",
"ratings": [
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"cwes": [
843
],
"description": "A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated document that includes an internal entity reference. An attacker could exploit this by providing a malicious document, leading to a type confusion error that causes the application to crash. This results in a denial of service (DoS), making the affected system or application unavailable.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-6732"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:11503"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-6732"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461300"
},
{
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/1097"
},
{
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/merge_requests/411"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6732"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6732"
}
],
"published": "2026-04-23T23:16:16+00:00",
"updated": "2026-05-15T14:36:35+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.9.7-21.el8_10.4",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.4?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-7168",
"ratings": [
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
294
],
"description": "Successfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-7168"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/04/29/14"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-7168"
},
{
"url": "https://curl.se/docs/CVE-2026-7168.html"
},
{
"url": "https://curl.se/docs/CVE-2026-7168.json"
},
{
"url": "https://hackerone.com/reports/3697719"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7168"
},
{
"url": "https://ubuntu.com/security/notices/USN-8227-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-7168"
}
],
"published": "2026-05-13T13:01:57+00:00",
"updated": "2026-05-14T14:12:48+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.11",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.11",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.11?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-7210",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
}
],
"cwes": [
331
],
"description": "`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\\r\\n\\r\\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-7210"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/05/11/13"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/05/11/8"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-7210"
},
{
"url": "https://github.com/python/cpython/commit/24b8f12544468e4cedf5bfbe25442fcd495391e4"
},
{
"url": "https://github.com/python/cpython/commit/3573b3b1ecbd99030a0b18658e1bfece771b2566"
},
{
"url": "https://github.com/python/cpython/commit/eeea765cb9d8f1fc3d8918b272ac3c477983f27a"
},
{
"url": "https://github.com/python/cpython/commit/fc9b11ff49cbc82e6f917d07a61517a2b5f3145f"
},
{
"url": "https://github.com/python/cpython/issues/149018"
},
{
"url": "https://github.com/python/cpython/pull/149023"
},
{
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/PNY5OMBDPM2FRUZTWFFPJ6LISWKV627K/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7210"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-7210"
}
],
"published": "2026-05-11T18:16:42+00:00",
"updated": "2026-06-15T17:51:07+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-76.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-76.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/platform-python@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/python3-libs@3.6.8-76.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-7383",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 5.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
787
],
"description": "Issue summary: A signed integer overflow when sizing the destination\nbuffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap\nbuffer overflow.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nattacker controlled code execution or other undefined behaviour.\n\nIn ASN1_mbstring_copy() and ASN1_mbstring_ncopy() the destination\nsize for Unicode output is computed in a signed int: by left shift\nof the input character count for BMPSTRING (UTF-16) and\nUNIVERSALSTRING (UTF-32), and by summing per-character byte counts\nfor UTF8STRING. The calculation overflows when the input reaches\naround 2^30 characters. In the worst case (UNIVERSALSTRING at 2^30\ncharacters) the size wraps to zero, OPENSSL_malloc(1) is called, and\nthe subsequent character copy writes several gigabytes past the\none-byte allocation.\n\nX.509 certificate processing routes through ASN1_STRING_set_by_NID(),\nwhose DIRSTRING_TYPE mask excludes UNIVERSALSTRING and whose per-NID\nsize limits cap the input length; no network protocol or\ncertificate-handling path in OpenSSL exercises the overflow.\nTriggering the bug requires an application that calls\nASN1_mbstring_copy() or ASN1_mbstring_ncopy() directly, or registers\na custom string type via ASN1_STRING_TABLE_add(), with\nattacker-controlled input on the order of half a gigabyte or more.\nFor these reasons this issue was assigned Low severity.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by\nthis issue, as the affected code is outside the OpenSSL FIPS module\nboundary.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-7383"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:25239"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-7383"
},
{
"url": "https://bugzilla.redhat.com/2481879"
},
{
"url": "https://bugzilla.redhat.com/2481880"
},
{
"url": "https://bugzilla.redhat.com/2481881"
},
{
"url": "https://bugzilla.redhat.com/2481882"
},
{
"url": "https://bugzilla.redhat.com/2481884"
},
{
"url": "https://bugzilla.redhat.com/2481885"
},
{
"url": "https://bugzilla.redhat.com/2481887"
},
{
"url": "https://bugzilla.redhat.com/2481890"
},
{
"url": "https://bugzilla.redhat.com/2481891"
},
{
"url": "https://bugzilla.redhat.com/2481892"
},
{
"url": "https://bugzilla.redhat.com/2481893"
},
{
"url": "https://bugzilla.redhat.com/2481894"
},
{
"url": "https://bugzilla.redhat.com/2481896"
},
{
"url": "https://bugzilla.redhat.com/2481897"
},
{
"url": "https://bugzilla.redhat.com/2481898"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481879"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481880"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481881"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481882"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481884"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481885"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481887"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481890"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481891"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481892"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481893"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481894"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481896"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481897"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34180"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34181"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34182"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34183"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42764"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42766"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42767"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42768"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42769"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42770"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45445"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45446"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45447"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7383"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9076"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-25239.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:25237"
},
{
"url": "https://github.com/openssl/openssl/commit/4f8d2bddaa2c8e06f9c33390ee1717059a6e4be6"
},
{
"url": "https://github.com/openssl/openssl/commit/80c15faaf78042bbb8654a0e234c50c381732f74"
},
{
"url": "https://github.com/openssl/openssl/commit/bd17511070fb39a67bfa19682affb765e706a974"
},
{
"url": "https://github.com/openssl/openssl/commit/c332adaced43bcbb85f97410597e951c11ec3083"
},
{
"url": "https://github.com/openssl/openssl/commit/d32350ae8ef7426718f5aa9e383d4b51398ee255"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7383"
},
{
"url": "https://openssl-library.org/news/secadv/20260609.txt"
},
{
"url": "https://ubuntu.com/security/notices/USN-8414-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8414-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-7383"
}
],
"published": "2026-06-09T17:17:50+00:00",
"updated": "2026-06-16T02:46:08+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
}
},
{
"id": "CVE-2026-9076",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 5.9,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
125
],
"description": "Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap)\nprocesses attacker-supplied CMS data, an attacker-chosen stream-mode KEK\ncipher can trigger a heap out-of-bounds read in kek_unwrap_key().\n\nImpact summary: A heap buffer over-read may trigger a crash which leads to\nDenial of Service for an application if the input buffer ends at a memory\npage boundary and the following page is unmapped. There is no information\ndisclosure as the over-read bytes are not revealed to the attacker.\n\nThe key unwrapping function performs a check-byte test as specified in the\nRFC that reads 7 bytes from a heap allocation that is based on the wrapped\nkey length from the message. There is a minimum length check based on the\nblock length of the wrapping cipher. However the cipher is selected from\nan OID carried in the attacker's PWRI keyEncryptionAlgorithm with no\nrequirement that the cipher be a block cipher. When an attacker selects\na stream-mode cipher the guard will be ineffective and the allocated buffer\ncontaining the unwrapped key can be too small to fit the check-bytes\nspecified in the RFC and a buffer over-read can happen.\n\nApplications calling CMS_decrypt() or CMS_decrypt_set1_password()\n(equivalently openssl cms -decrypt -pwri_password ...) on untrusted CMS\ndata are vulnerable to this issue. No password knowledge is required: the\nover-read happens during the unwrap attempt before any authentication\nsucceeds.\n\nThe over-read is limited to a few bytes and is not written to output, so\nthere is no information disclosure. Triggering a crash requires the\nallocation to border unmapped memory, which is unlikely with the normal\nallocator.\n\nThe FIPS modules are not affected by this issue.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-9076"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:25239"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-9076"
},
{
"url": "https://bugzilla.redhat.com/2481879"
},
{
"url": "https://bugzilla.redhat.com/2481880"
},
{
"url": "https://bugzilla.redhat.com/2481881"
},
{
"url": "https://bugzilla.redhat.com/2481882"
},
{
"url": "https://bugzilla.redhat.com/2481884"
},
{
"url": "https://bugzilla.redhat.com/2481885"
},
{
"url": "https://bugzilla.redhat.com/2481887"
},
{
"url": "https://bugzilla.redhat.com/2481890"
},
{
"url": "https://bugzilla.redhat.com/2481891"
},
{
"url": "https://bugzilla.redhat.com/2481892"
},
{
"url": "https://bugzilla.redhat.com/2481893"
},
{
"url": "https://bugzilla.redhat.com/2481894"
},
{
"url": "https://bugzilla.redhat.com/2481896"
},
{
"url": "https://bugzilla.redhat.com/2481897"
},
{
"url": "https://bugzilla.redhat.com/2481898"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481879"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481880"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481881"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481882"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481884"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481885"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481887"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481890"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481891"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481892"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481893"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481894"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481896"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481897"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481898"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34180"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34181"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34182"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34183"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42764"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42766"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42767"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42768"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42769"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42770"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45445"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45446"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45447"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7383"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9076"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-25239.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:25237"
},
{
"url": "https://github.com/openssl/openssl/commit/05b066366842f930fadd9a6e94df98030af431bb"
},
{
"url": "https://github.com/openssl/openssl/commit/3d8d5bc1056b2f62da9fede23fedbf47e85187b0"
},
{
"url": "https://github.com/openssl/openssl/commit/715349a1d7c6db970e6815dafb90915f07307f98"
},
{
"url": "https://github.com/openssl/openssl/commit/77bf00ab13f6ff5e516535432f0328ed70ec0c26"
},
{
"url": "https://github.com/openssl/openssl/commit/eecbe330977e8d023aae1ca2d9bdbe983ef3fdc6"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9076"
},
{
"url": "https://openssl-library.org/news/secadv/20260609.txt"
},
{
"url": "https://ubuntu.com/security/notices/USN-8414-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8414-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-9076"
}
],
"published": "2026-06-09T17:17:50+00:00",
"updated": "2026-06-16T02:45:58+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
}
},
{
"id": "CVE-2026-9149",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "nvd"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
}
],
"cwes": [
122
],
"description": "A flaw was found in libsolv. This heap buffer overflow vulnerability occurs when a victim processes a specially crafted `.solv` file containing negative size values in the `repo_add_solv` function. This leads to an undersized memory allocation and a subsequent out-of-bounds write. An attacker could exploit this to cause a denial of service (DoS).",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-9149"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-9149"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460380"
},
{
"url": "https://github.com/openSUSE/libsolv/pull/617"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9149"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-9149"
}
],
"published": "2026-05-21T00:16:35+00:00",
"updated": "2026-06-02T01:21:26+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "0.7.20-6.el8",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c445a820-4608-4489-b314-b15116d76441/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:rpm/redhat/libsolv@0.7.20-6.el8?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "GHSA-537c-gmf6-5ccf",
"source": {
"name": "ghsa",
"url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip"
},
"ratings": [
{
"source": {
"name": "ghsa"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"description": "pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in wheels prior to cryptograph 48.01 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://openssl-library.org/news/secadv/20260609.txt.\n\nIf you are building cryptography source (\"sdist\") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions.",
"recommendation": "Upgrade cryptography to version 48.0.1",
"advisories": [
{
"url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf"
},
{
"url": "https://github.com/pyca/cryptography"
},
{
"url": "https://github.com/pyca/cryptography/security/advisories/GHSA-537c-gmf6-5ccf"
},
{
"url": "https://openssl-library.org/news/secadv/20260609.txt"
}
],
"published": "2026-06-15T20:12:27+00:00",
"updated": "2026-06-15T20:12:27+00:00",
"affects": [
{
"ref": "pkg:pypi/cryptography@46.0.7",
"versions": [
{
"version": "46.0.7",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:pypi/cryptography@46.0.7"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:pypi/cryptography@46.0.7"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:pypi/cryptography@46.0.7"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:pypi/cryptography@46.0.7"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:pypi/cryptography@46.0.7"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:pypi/cryptography@46.0.7"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:pypi/cryptography@46.0.7"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:pypi/cryptography@46.0.7"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:pypi/cryptography@46.0.7"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:pypi/cryptography@46.0.7"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:pypi/cryptography@46.0.7"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:pypi/cryptography@46.0.7"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:pypi/cryptography@46.0.7"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:pypi/cryptography@46.0.7"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:pypi/cryptography@46.0.7"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:pypi/cryptography@46.0.7"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:pypi/cryptography@46.0.7"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:pypi/cryptography@46.0.7"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:pypi/cryptography@46.0.7"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": null
}
},
{
"id": "GHSA-qp9x-wp8f-qgjj",
"source": {
"name": "ghsa",
"url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip"
},
"ratings": [
{
"source": {
"name": "ghsa"
},
"score": 4,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
}
],
"description": "`DelegatedRole._is_target_in_pathpattern` uses `fnmatch.fnmatch` to decide whether a given target path is authorized by a delegation's glob pattern.\n\nPython's `fnmatch.fnmatch` calls `os.path.normcase()` on both arguments before matching. On POSIX hosts `normcase` is the identity function; on Windows hosts `os.path` resolves to `ntpath`, whose `normcase` lowercases its input and replaces `/` with `\\`.\n\nAs a result, python-tuf's delegation *path pattern* matching is case-sensitive on Linux/macOS but case-INSENSITIVE on Windows. This makes the authorization decision for a target dependent on the host operating system of the client running the updater.\n\nThe result on Windows is a TUF specification violation in the python-tuf `ngclient` implementation.\n\n## Vulnerable code\n\n`tuf/api/_payload.py` (HEAD `7ecb67d`):\n\n```python\n1183 @staticmethod\n1184 def _is_target_in_pathpattern(targetpath: str, pathpattern: str) -> bool:\n1185 \"\"\"Determine whether ``targetpath`` matches the ``pathpattern``.\"\"\"\n1186 # We need to make sure that targetpath and pathpattern are pointing to\n1187 # the same directory as fnmatch doesn't threat \"/\" as a special symbol.\n1188 target_parts = targetpath.split(\"/\")\n1189 pattern_parts = pathpattern.split(\"/\")\n1190 if len(target_parts) != len(pattern_parts):\n1191 return False\n1192\n1193 # Every part in the pathpattern could include a glob pattern, that's why\n1194 # each of the target and pathpattern parts should match.\n1195 for target, pattern in zip(target_parts, pattern_parts, strict=True):\n1196 if not fnmatch.fnmatch(target, pattern):\n1197 return False\n1198 return True\n```\n\n`fnmatch.fnmatch` source (Python 3.12, unchanged in current mainline):\n\n```python\ndef fnmatch(name, pat):\n ...\n name = os.path.normcase(name)\n pat = os.path.normcase(pat)\n return fnmatchcase(name, pat)\n```\n\n## Fix\n\nReplace `fnmatch.fnmatch` with `fnmatch.fnmatchcase`, which is explicitly documented as \"not applying case normalization\", so it behaves identically across platforms.\n\n## Attack\n\n1. A TUF repository with two path-based delegations whose patterns differ only in case \u2014 for example, `Foo/*` and `foo/*`.\n2. The \"attacker\" delegation is listed BEFORE the \"legit\" delegation in the delegation order.\n3. The client searches for `foo/something`: on Windows, it will find the \"attacker\" provided target \"Foo/something\".\n\n\n## Exploitability caveats \n\n* The attack needs a repository configuration with case-colliding delegation path patterns. The attacker must control one of the delegated roles.\n* Delegation ordering matters: the attacker-controlled role must be visited BEFORE the legit role in the pre-order walk.\n* The client must run on Windows. No effect on Linux/macOS.\n\n## Credit\n\nReporter: Koda Reef @kodareef5 \nAdvisory edits: Jussi Kukkonen @jku",
"recommendation": "Upgrade tuf to version 7.0.0",
"advisories": [
{
"url": "https://github.com/advisories/GHSA-qp9x-wp8f-qgjj"
},
{
"url": "https://github.com/theupdateframework/python-tuf"
},
{
"url": "https://github.com/theupdateframework/python-tuf/releases/tag/v7.0.0"
},
{
"url": "https://github.com/theupdateframework/python-tuf/security/advisories/GHSA-qp9x-wp8f-qgjj"
}
],
"published": "2026-05-28T22:46:13+00:00",
"updated": "2026-05-28T22:46:13+00:00",
"affects": [
{
"ref": "pkg:pypi/tuf@6.0.0",
"versions": [
{
"version": "6.0.0",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:021d46fa-1768-4e40-85d0-4c4561e3645b/1#pkg:pypi/tuf@6.0.0"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:pypi/tuf@6.0.0"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:pypi/tuf@6.0.0"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:pypi/tuf@6.0.0"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:pypi/tuf@6.0.0"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:pypi/tuf@6.0.0"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:pypi/tuf@6.0.0"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:pypi/tuf@6.0.0"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:pypi/tuf@6.0.0"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#pkg:pypi/tuf@6.0.0"
},
{
"ref": "urn:cdx:25957a15-1c20-40bd-a0c6-a945a9ecf6ea/1#pkg:pypi/tuf@6.0.0"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:pypi/tuf@6.0.0"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#pkg:pypi/tuf@6.0.0"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:pypi/tuf@6.0.0"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:pypi/tuf@6.0.0"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:pypi/tuf@6.0.0"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:pypi/tuf@6.0.0"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:pypi/tuf@6.0.0"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#pkg:pypi/tuf@6.0.0"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2024-6763",
"source": {
"name": "ghsa",
"url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
},
"ratings": [
{
"source": {
"name": "ghsa"
},
"score": 3.7,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
{
"source": {
"name": "nvd"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
{
"source": {
"name": "redhat"
},
"score": 3.7,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
1286
],
"description": "Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing.\n\nThe HttpURI class does insufficient validation on the authority segment of a URI. However the behaviour of HttpURI\n differs from the common browsers in how it handles a URI that would be \nconsidered invalid if fully validated against the RRC. Specifically HttpURI\n and the browser may differ on the value of the host extracted from an \ninvalid URI and thus a combination of Jetty and a vulnerable browser may\n be vulnerable to a open redirect attack or to a SSRF attack if the URI \nis used after passing validation checks.",
"recommendation": "Upgrade org.eclipse.jetty:jetty-http to version 12.0.12",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2024-6763"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-6763"
},
{
"url": "https://github.com/jetty/jetty.project"
},
{
"url": "https://github.com/jetty/jetty.project/pull/12012"
},
{
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-qh8g-58pp-2wxh"
},
{
"url": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/25"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6763"
},
{
"url": "https://security.netapp.com/advisory/ntap-20250306-0005"
},
{
"url": "https://security.netapp.com/advisory/ntap-20250306-0005/"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2024-6763"
}
],
"published": "2024-10-14T16:15:04+00:00",
"updated": "2025-07-10T15:04:04+00:00",
"affects": [
{
"ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.61",
"versions": [
{
"version": "9.4.61",
"status": "affected"
}
]
},
{
"ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.61",
"versions": [
{
"version": "9.4.61",
"status": "affected"
}
]
},
{
"ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.60",
"versions": [
{
"version": "9.4.60",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#1a1b97ce-b778-4b62-bfaa-49c042f2cc89"
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#1a1b97ce-b778-4b62-bfaa-49c042f2cc89"
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.60"
},
{
"ref": "urn:cdx:420fae46-98b4-4a4e-a565-5c885ce54dc7/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.61"
},
{
"ref": "urn:cdx:420fae46-98b4-4a4e-a565-5c885ce54dc7/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.61"
},
{
"ref": "urn:cdx:605c4cf6-768c-4740-88af-644c86949366/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.61"
},
{
"ref": "urn:cdx:605c4cf6-768c-4740-88af-644c86949366/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.61"
},
{
"ref": "urn:cdx:605c4cf6-768c-4740-88af-644c86949366/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.60"
},
{
"ref": "urn:cdx:5edaa6b5-97a5-4cb5-86fd-5c8da204e917/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.61"
},
{
"ref": "urn:cdx:5edaa6b5-97a5-4cb5-86fd-5c8da204e917/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.61"
},
{
"ref": "urn:cdx:00efd76e-fc8f-48fa-a71d-c9d70b5f9447/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.60"
},
{
"ref": "urn:cdx:5c15d8a3-b4c2-4b3e-942e-57b2854d6d7c/1#acb524a5-8a34-4078-b0d8-bcc5cc997067"
},
{
"ref": "urn:cdx:5c15d8a3-b4c2-4b3e-942e-57b2854d6d7c/1#acb524a5-8a34-4078-b0d8-bcc5cc997067"
},
{
"ref": "urn:cdx:1984c021-252b-4038-b5c2-7dc58cdccb34/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.61"
},
{
"ref": "urn:cdx:1984c021-252b-4038-b5c2-7dc58cdccb34/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.61"
},
{
"ref": "urn:cdx:d9316630-0b4e-424a-9b57-0891facfdb48/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.61"
},
{
"ref": "urn:cdx:d9316630-0b4e-424a-9b57-0891facfdb48/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.61"
},
{
"ref": "urn:cdx:0bc95285-afe2-4a8c-b014-7ea60e19327f/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.61"
},
{
"ref": "urn:cdx:0bc95285-afe2-4a8c-b014-7ea60e19327f/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.61"
},
{
"ref": "urn:cdx:e3b6f2fe-2151-4091-9340-33890017b22a/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.61"
},
{
"ref": "urn:cdx:e3b6f2fe-2151-4091-9340-33890017b22a/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.61"
},
{
"ref": "urn:cdx:9248c11a-a6c2-4e62-9a2e-7f374f557cd6/1#15a667e8-0607-40ee-9e11-f6bc62a4e516"
},
{
"ref": "urn:cdx:9248c11a-a6c2-4e62-9a2e-7f374f557cd6/1#15a667e8-0607-40ee-9e11-f6bc62a4e516"
},
{
"ref": "urn:cdx:41ca6524-f05d-4db2-91ba-d967a3eecf30/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.60"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.61"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.61"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.60"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#587bac6b-3bf5-466b-af83-20711949699d"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#587bac6b-3bf5-466b-af83-20711949699d"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.61"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.61"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.60"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#30131120-8c26-4bd3-bf8e-4b27de722d7a"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#30131120-8c26-4bd3-bf8e-4b27de722d7a"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.60"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#3a02fe35-b5c8-4586-a073-451fe7940331"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#3a02fe35-b5c8-4586-a073-451fe7940331"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.60"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.60"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#2ae56661-0404-4be9-b19d-17372fd8dc9e"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#2ae56661-0404-4be9-b19d-17372fd8dc9e"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.60"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#d2c271d9-9c9f-4d7c-af55-00402f4ebb8e"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#d2c271d9-9c9f-4d7c-af55-00402f4ebb8e"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.60"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.61"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.61"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#3d718ef0-00df-4e2b-b587-4d24012fa101"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#3d718ef0-00df-4e2b-b587-4d24012fa101"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.61"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.61"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#1c5f1645-fca1-4f53-9d17-2f4e34bbf292"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#1c5f1645-fca1-4f53-9d17-2f4e34bbf292"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#26dccb18-aa78-41c7-83db-67d4a0b46cf9"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#26dccb18-aa78-41c7-83db-67d4a0b46cf9"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#0be6b7eb-6cda-4937-99d9-e93fc9e24d81"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#0be6b7eb-6cda-4937-99d9-e93fc9e24d81"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.60"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#3aa5a039-fba4-482f-82a6-12ad967f313f"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#3aa5a039-fba4-482f-82a6-12ad967f313f"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.60"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#335e3cb4-067a-4b9d-b06a-41f888b58193"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#335e3cb4-067a-4b9d-b06a-41f888b58193"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.60"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.60"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#4d20c27c-3b63-4248-9bb4-bb2c5f578afd"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#4d20c27c-3b63-4248-9bb4-bb2c5f578afd"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "This vulnerability is not exploitable in the context of Confluent Platform as URIs are not used to pass sensitive information. "
}
},
{
"id": "CVE-2026-44249",
"source": {
"name": "ghsa",
"url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
},
"ratings": [
{
"source": {
"name": "ghsa"
},
"score": 8.1,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 8.1,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"cwes": [
284,
697
],
"description": "Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue.",
"recommendation": "Upgrade io.netty:netty-handler to version 4.2.15.Final, 4.1.135.Final",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-44249"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-44249"
},
{
"url": "https://github.com/netty/netty"
},
{
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"url": "https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44249"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44249"
}
],
"published": "2026-06-11T22:16:56+00:00",
"updated": "2026-06-15T02:30:46+00:00",
"affects": [
{
"ref": "pkg:maven/io.netty/netty-handler@4.1.133.Final",
"versions": [
{
"version": "4.1.133.Final",
"status": "affected"
}
]
},
{
"ref": "pkg:maven/io.netty/netty-handler@4.1.133.Final",
"versions": [
{
"version": "4.1.133.Final",
"status": "affected"
}
]
},
{
"ref": "pkg:maven/io.netty/netty-handler@4.1.133.Final",
"versions": [
{
"version": "4.1.133.Final",
"status": "affected"
}
]
},
{
"ref": "pkg:maven/io.netty/netty-handler@4.1.133.Final",
"versions": [
{
"version": "4.1.133.Final",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#37c2beb5-ed54-4208-88be-327232338d84"
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#37c2beb5-ed54-4208-88be-327232338d84"
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#37c2beb5-ed54-4208-88be-327232338d84"
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#37c2beb5-ed54-4208-88be-327232338d84"
},
{
"ref": "urn:cdx:605c4cf6-768c-4740-88af-644c86949366/1#a92097ac-b709-4542-a2d8-e01b63edbd42"
},
{
"ref": "urn:cdx:605c4cf6-768c-4740-88af-644c86949366/1#a92097ac-b709-4542-a2d8-e01b63edbd42"
},
{
"ref": "urn:cdx:605c4cf6-768c-4740-88af-644c86949366/1#a92097ac-b709-4542-a2d8-e01b63edbd42"
},
{
"ref": "urn:cdx:605c4cf6-768c-4740-88af-644c86949366/1#a92097ac-b709-4542-a2d8-e01b63edbd42"
},
{
"ref": "urn:cdx:5edaa6b5-97a5-4cb5-86fd-5c8da204e917/1#047bcb7c-edfb-4b9f-81a1-064e6d23fbf6"
},
{
"ref": "urn:cdx:5edaa6b5-97a5-4cb5-86fd-5c8da204e917/1#047bcb7c-edfb-4b9f-81a1-064e6d23fbf6"
},
{
"ref": "urn:cdx:5edaa6b5-97a5-4cb5-86fd-5c8da204e917/1#047bcb7c-edfb-4b9f-81a1-064e6d23fbf6"
},
{
"ref": "urn:cdx:5edaa6b5-97a5-4cb5-86fd-5c8da204e917/1#047bcb7c-edfb-4b9f-81a1-064e6d23fbf6"
},
{
"ref": "urn:cdx:00efd76e-fc8f-48fa-a71d-c9d70b5f9447/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:00efd76e-fc8f-48fa-a71d-c9d70b5f9447/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:00efd76e-fc8f-48fa-a71d-c9d70b5f9447/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:00efd76e-fc8f-48fa-a71d-c9d70b5f9447/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:5c15d8a3-b4c2-4b3e-942e-57b2854d6d7c/1#16b3b91c-aa4e-4f76-9f50-f82831e7792f"
},
{
"ref": "urn:cdx:5c15d8a3-b4c2-4b3e-942e-57b2854d6d7c/1#16b3b91c-aa4e-4f76-9f50-f82831e7792f"
},
{
"ref": "urn:cdx:5c15d8a3-b4c2-4b3e-942e-57b2854d6d7c/1#16b3b91c-aa4e-4f76-9f50-f82831e7792f"
},
{
"ref": "urn:cdx:5c15d8a3-b4c2-4b3e-942e-57b2854d6d7c/1#16b3b91c-aa4e-4f76-9f50-f82831e7792f"
},
{
"ref": "urn:cdx:1984c021-252b-4038-b5c2-7dc58cdccb34/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:1984c021-252b-4038-b5c2-7dc58cdccb34/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:1984c021-252b-4038-b5c2-7dc58cdccb34/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:1984c021-252b-4038-b5c2-7dc58cdccb34/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:c04a5fc7-a5fb-4f38-bfed-0fa15f9fd95f/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:c04a5fc7-a5fb-4f38-bfed-0fa15f9fd95f/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:c04a5fc7-a5fb-4f38-bfed-0fa15f9fd95f/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:c04a5fc7-a5fb-4f38-bfed-0fa15f9fd95f/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:d9316630-0b4e-424a-9b57-0891facfdb48/1#25cce3bb-48df-4d8d-81e6-79e40e6f46f8"
},
{
"ref": "urn:cdx:d9316630-0b4e-424a-9b57-0891facfdb48/1#25cce3bb-48df-4d8d-81e6-79e40e6f46f8"
},
{
"ref": "urn:cdx:d9316630-0b4e-424a-9b57-0891facfdb48/1#25cce3bb-48df-4d8d-81e6-79e40e6f46f8"
},
{
"ref": "urn:cdx:d9316630-0b4e-424a-9b57-0891facfdb48/1#25cce3bb-48df-4d8d-81e6-79e40e6f46f8"
},
{
"ref": "urn:cdx:b5e3ea0e-3953-4d71-9f97-b04d97cc22f4/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:b5e3ea0e-3953-4d71-9f97-b04d97cc22f4/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:b5e3ea0e-3953-4d71-9f97-b04d97cc22f4/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:b5e3ea0e-3953-4d71-9f97-b04d97cc22f4/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:0bc95285-afe2-4a8c-b014-7ea60e19327f/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:0bc95285-afe2-4a8c-b014-7ea60e19327f/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:0bc95285-afe2-4a8c-b014-7ea60e19327f/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:0bc95285-afe2-4a8c-b014-7ea60e19327f/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:32a0fc77-dccf-43c8-8d4e-779797d168d8/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:32a0fc77-dccf-43c8-8d4e-779797d168d8/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:32a0fc77-dccf-43c8-8d4e-779797d168d8/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:32a0fc77-dccf-43c8-8d4e-779797d168d8/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:9248c11a-a6c2-4e62-9a2e-7f374f557cd6/1#135f630d-516f-4cf4-94fd-24f64dfd0991"
},
{
"ref": "urn:cdx:9248c11a-a6c2-4e62-9a2e-7f374f557cd6/1#135f630d-516f-4cf4-94fd-24f64dfd0991"
},
{
"ref": "urn:cdx:9248c11a-a6c2-4e62-9a2e-7f374f557cd6/1#135f630d-516f-4cf4-94fd-24f64dfd0991"
},
{
"ref": "urn:cdx:9248c11a-a6c2-4e62-9a2e-7f374f557cd6/1#135f630d-516f-4cf4-94fd-24f64dfd0991"
},
{
"ref": "urn:cdx:41ca6524-f05d-4db2-91ba-d967a3eecf30/1#88ef17f0-c17a-4dd6-89d5-092f64483a75"
},
{
"ref": "urn:cdx:41ca6524-f05d-4db2-91ba-d967a3eecf30/1#88ef17f0-c17a-4dd6-89d5-092f64483a75"
},
{
"ref": "urn:cdx:41ca6524-f05d-4db2-91ba-d967a3eecf30/1#88ef17f0-c17a-4dd6-89d5-092f64483a75"
},
{
"ref": "urn:cdx:41ca6524-f05d-4db2-91ba-d967a3eecf30/1#88ef17f0-c17a-4dd6-89d5-092f64483a75"
},
{
"ref": "urn:cdx:d3b561a2-679f-4ee3-9e2d-46972f27bfa5/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:d3b561a2-679f-4ee3-9e2d-46972f27bfa5/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:d3b561a2-679f-4ee3-9e2d-46972f27bfa5/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:d3b561a2-679f-4ee3-9e2d-46972f27bfa5/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#98cf1bd1-9cc9-4b31-8c8e-006109dea75f"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#98cf1bd1-9cc9-4b31-8c8e-006109dea75f"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#98cf1bd1-9cc9-4b31-8c8e-006109dea75f"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#98cf1bd1-9cc9-4b31-8c8e-006109dea75f"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#66438181-1402-45e2-bb43-543c9ecd2f2d"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#66438181-1402-45e2-bb43-543c9ecd2f2d"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#66438181-1402-45e2-bb43-543c9ecd2f2d"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#66438181-1402-45e2-bb43-543c9ecd2f2d"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#772673bc-cc3e-4e4d-b468-6c7b46bc33a8"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#772673bc-cc3e-4e4d-b468-6c7b46bc33a8"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#772673bc-cc3e-4e4d-b468-6c7b46bc33a8"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#772673bc-cc3e-4e4d-b468-6c7b46bc33a8"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#2805e2d9-5f42-437d-9946-ca02368992b3"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#2805e2d9-5f42-437d-9946-ca02368992b3"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#2805e2d9-5f42-437d-9946-ca02368992b3"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#2805e2d9-5f42-437d-9946-ca02368992b3"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#031b59ef-faee-4211-ba14-ff42b04b5400"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#031b59ef-faee-4211-ba14-ff42b04b5400"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#031b59ef-faee-4211-ba14-ff42b04b5400"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#031b59ef-faee-4211-ba14-ff42b04b5400"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#0077b380-579f-47e4-850d-ce2a5dfd967c"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#0077b380-579f-47e4-850d-ce2a5dfd967c"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#0077b380-579f-47e4-850d-ce2a5dfd967c"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#0077b380-579f-47e4-850d-ce2a5dfd967c"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#4082167c-50df-4572-8fb7-5f292763265e"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#4082167c-50df-4572-8fb7-5f292763265e"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#4082167c-50df-4572-8fb7-5f292763265e"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#4082167c-50df-4572-8fb7-5f292763265e"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#1fed2ce7-23fc-4448-a23e-ae69ad84151c"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#1fed2ce7-23fc-4448-a23e-ae69ad84151c"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#1fed2ce7-23fc-4448-a23e-ae69ad84151c"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#1fed2ce7-23fc-4448-a23e-ae69ad84151c"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#37cd69d0-8a17-442b-ae26-b63270307d15"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#37cd69d0-8a17-442b-ae26-b63270307d15"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#37cd69d0-8a17-442b-ae26-b63270307d15"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#37cd69d0-8a17-442b-ae26-b63270307d15"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#a9d5648d-6275-4268-83a3-698ce5fdf16d"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#a9d5648d-6275-4268-83a3-698ce5fdf16d"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#a9d5648d-6275-4268-83a3-698ce5fdf16d"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#a9d5648d-6275-4268-83a3-698ce5fdf16d"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#07a67c48-cde2-43b3-94da-ca47a526c7f5"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#07a67c48-cde2-43b3-94da-ca47a526c7f5"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#07a67c48-cde2-43b3-94da-ca47a526c7f5"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#07a67c48-cde2-43b3-94da-ca47a526c7f5"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#05c74c07-d4e8-47a5-916f-dfeb102fee06"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#05c74c07-d4e8-47a5-916f-dfeb102fee06"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#05c74c07-d4e8-47a5-916f-dfeb102fee06"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#05c74c07-d4e8-47a5-916f-dfeb102fee06"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#10816bbd-0797-4d62-86cf-856806060923"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#10816bbd-0797-4d62-86cf-856806060923"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#10816bbd-0797-4d62-86cf-856806060923"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#10816bbd-0797-4d62-86cf-856806060923"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#04db8419-4978-4458-a34e-e2f50653a407"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#04db8419-4978-4458-a34e-e2f50653a407"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#04db8419-4978-4458-a34e-e2f50653a407"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#04db8419-4978-4458-a34e-e2f50653a407"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#02171dc6-0a0b-44c2-a189-4115dcae56d9"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#02171dc6-0a0b-44c2-a189-4115dcae56d9"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#02171dc6-0a0b-44c2-a189-4115dcae56d9"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#02171dc6-0a0b-44c2-a189-4115dcae56d9"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#4916c288-7136-410d-9fca-33e8908bfb9f"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#4916c288-7136-410d-9fca-33e8908bfb9f"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#4916c288-7136-410d-9fca-33e8908bfb9f"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#4916c288-7136-410d-9fca-33e8908bfb9f"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-45416",
"source": {
"name": "ghsa",
"url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
},
"ratings": [
{
"source": {
"name": "ghsa"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"cwes": [
770
],
"description": "Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly allocates `ctx.alloc().buffer(handshakeLength)` (line 161). The guard at line 140 is `handshakeLength > maxClientHelloLength && maxClientHelloLength != 0`, and the commonly-used SniHandler/AbstractSniHandler constructors (SniHandler(Mapping), SniHandler(AsyncMapping), AbstractSniHandler()) pass maxClientHelloLength=0 and handshakeTimeoutMillis=0, so the length guard is disabled and no timeout is scheduled. A 16 MiB request exceeds the default pooled chunk size and becomes a huge/unpooled allocation performed immediately. The buffer is retained in the handler until the channel closes. Versions 4.1.135.Final and 4.2.15.Final patch the issue.",
"recommendation": "Upgrade io.netty:netty-handler to version 4.2.15.Final, 4.1.135.Final",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-45416"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-45416"
},
{
"url": "https://github.com/netty/netty"
},
{
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"url": "https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45416"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45416"
}
],
"published": "2026-06-12T15:16:26+00:00",
"updated": "2026-06-15T02:15:04+00:00",
"affects": [
{
"ref": "pkg:maven/io.netty/netty-handler@4.1.133.Final",
"versions": [
{
"version": "4.1.133.Final",
"status": "affected"
}
]
},
{
"ref": "pkg:maven/io.netty/netty-handler@4.1.133.Final",
"versions": [
{
"version": "4.1.133.Final",
"status": "affected"
}
]
},
{
"ref": "pkg:maven/io.netty/netty-handler@4.1.133.Final",
"versions": [
{
"version": "4.1.133.Final",
"status": "affected"
}
]
},
{
"ref": "pkg:maven/io.netty/netty-handler@4.1.133.Final",
"versions": [
{
"version": "4.1.133.Final",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#37c2beb5-ed54-4208-88be-327232338d84"
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#37c2beb5-ed54-4208-88be-327232338d84"
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#37c2beb5-ed54-4208-88be-327232338d84"
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#37c2beb5-ed54-4208-88be-327232338d84"
},
{
"ref": "urn:cdx:605c4cf6-768c-4740-88af-644c86949366/1#a92097ac-b709-4542-a2d8-e01b63edbd42"
},
{
"ref": "urn:cdx:605c4cf6-768c-4740-88af-644c86949366/1#a92097ac-b709-4542-a2d8-e01b63edbd42"
},
{
"ref": "urn:cdx:605c4cf6-768c-4740-88af-644c86949366/1#a92097ac-b709-4542-a2d8-e01b63edbd42"
},
{
"ref": "urn:cdx:605c4cf6-768c-4740-88af-644c86949366/1#a92097ac-b709-4542-a2d8-e01b63edbd42"
},
{
"ref": "urn:cdx:5edaa6b5-97a5-4cb5-86fd-5c8da204e917/1#047bcb7c-edfb-4b9f-81a1-064e6d23fbf6"
},
{
"ref": "urn:cdx:5edaa6b5-97a5-4cb5-86fd-5c8da204e917/1#047bcb7c-edfb-4b9f-81a1-064e6d23fbf6"
},
{
"ref": "urn:cdx:5edaa6b5-97a5-4cb5-86fd-5c8da204e917/1#047bcb7c-edfb-4b9f-81a1-064e6d23fbf6"
},
{
"ref": "urn:cdx:5edaa6b5-97a5-4cb5-86fd-5c8da204e917/1#047bcb7c-edfb-4b9f-81a1-064e6d23fbf6"
},
{
"ref": "urn:cdx:00efd76e-fc8f-48fa-a71d-c9d70b5f9447/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:00efd76e-fc8f-48fa-a71d-c9d70b5f9447/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:00efd76e-fc8f-48fa-a71d-c9d70b5f9447/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:00efd76e-fc8f-48fa-a71d-c9d70b5f9447/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:5c15d8a3-b4c2-4b3e-942e-57b2854d6d7c/1#16b3b91c-aa4e-4f76-9f50-f82831e7792f"
},
{
"ref": "urn:cdx:5c15d8a3-b4c2-4b3e-942e-57b2854d6d7c/1#16b3b91c-aa4e-4f76-9f50-f82831e7792f"
},
{
"ref": "urn:cdx:5c15d8a3-b4c2-4b3e-942e-57b2854d6d7c/1#16b3b91c-aa4e-4f76-9f50-f82831e7792f"
},
{
"ref": "urn:cdx:5c15d8a3-b4c2-4b3e-942e-57b2854d6d7c/1#16b3b91c-aa4e-4f76-9f50-f82831e7792f"
},
{
"ref": "urn:cdx:1984c021-252b-4038-b5c2-7dc58cdccb34/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:1984c021-252b-4038-b5c2-7dc58cdccb34/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:1984c021-252b-4038-b5c2-7dc58cdccb34/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:1984c021-252b-4038-b5c2-7dc58cdccb34/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:c04a5fc7-a5fb-4f38-bfed-0fa15f9fd95f/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:c04a5fc7-a5fb-4f38-bfed-0fa15f9fd95f/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:c04a5fc7-a5fb-4f38-bfed-0fa15f9fd95f/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:c04a5fc7-a5fb-4f38-bfed-0fa15f9fd95f/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:d9316630-0b4e-424a-9b57-0891facfdb48/1#25cce3bb-48df-4d8d-81e6-79e40e6f46f8"
},
{
"ref": "urn:cdx:d9316630-0b4e-424a-9b57-0891facfdb48/1#25cce3bb-48df-4d8d-81e6-79e40e6f46f8"
},
{
"ref": "urn:cdx:d9316630-0b4e-424a-9b57-0891facfdb48/1#25cce3bb-48df-4d8d-81e6-79e40e6f46f8"
},
{
"ref": "urn:cdx:d9316630-0b4e-424a-9b57-0891facfdb48/1#25cce3bb-48df-4d8d-81e6-79e40e6f46f8"
},
{
"ref": "urn:cdx:b5e3ea0e-3953-4d71-9f97-b04d97cc22f4/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:b5e3ea0e-3953-4d71-9f97-b04d97cc22f4/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:b5e3ea0e-3953-4d71-9f97-b04d97cc22f4/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:b5e3ea0e-3953-4d71-9f97-b04d97cc22f4/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:0bc95285-afe2-4a8c-b014-7ea60e19327f/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:0bc95285-afe2-4a8c-b014-7ea60e19327f/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:0bc95285-afe2-4a8c-b014-7ea60e19327f/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:0bc95285-afe2-4a8c-b014-7ea60e19327f/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:32a0fc77-dccf-43c8-8d4e-779797d168d8/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:32a0fc77-dccf-43c8-8d4e-779797d168d8/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:32a0fc77-dccf-43c8-8d4e-779797d168d8/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:32a0fc77-dccf-43c8-8d4e-779797d168d8/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:9248c11a-a6c2-4e62-9a2e-7f374f557cd6/1#135f630d-516f-4cf4-94fd-24f64dfd0991"
},
{
"ref": "urn:cdx:9248c11a-a6c2-4e62-9a2e-7f374f557cd6/1#135f630d-516f-4cf4-94fd-24f64dfd0991"
},
{
"ref": "urn:cdx:9248c11a-a6c2-4e62-9a2e-7f374f557cd6/1#135f630d-516f-4cf4-94fd-24f64dfd0991"
},
{
"ref": "urn:cdx:9248c11a-a6c2-4e62-9a2e-7f374f557cd6/1#135f630d-516f-4cf4-94fd-24f64dfd0991"
},
{
"ref": "urn:cdx:41ca6524-f05d-4db2-91ba-d967a3eecf30/1#88ef17f0-c17a-4dd6-89d5-092f64483a75"
},
{
"ref": "urn:cdx:41ca6524-f05d-4db2-91ba-d967a3eecf30/1#88ef17f0-c17a-4dd6-89d5-092f64483a75"
},
{
"ref": "urn:cdx:41ca6524-f05d-4db2-91ba-d967a3eecf30/1#88ef17f0-c17a-4dd6-89d5-092f64483a75"
},
{
"ref": "urn:cdx:41ca6524-f05d-4db2-91ba-d967a3eecf30/1#88ef17f0-c17a-4dd6-89d5-092f64483a75"
},
{
"ref": "urn:cdx:d3b561a2-679f-4ee3-9e2d-46972f27bfa5/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:d3b561a2-679f-4ee3-9e2d-46972f27bfa5/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:d3b561a2-679f-4ee3-9e2d-46972f27bfa5/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:d3b561a2-679f-4ee3-9e2d-46972f27bfa5/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#98cf1bd1-9cc9-4b31-8c8e-006109dea75f"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#98cf1bd1-9cc9-4b31-8c8e-006109dea75f"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#98cf1bd1-9cc9-4b31-8c8e-006109dea75f"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#98cf1bd1-9cc9-4b31-8c8e-006109dea75f"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#66438181-1402-45e2-bb43-543c9ecd2f2d"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#66438181-1402-45e2-bb43-543c9ecd2f2d"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#66438181-1402-45e2-bb43-543c9ecd2f2d"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#66438181-1402-45e2-bb43-543c9ecd2f2d"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#772673bc-cc3e-4e4d-b468-6c7b46bc33a8"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#772673bc-cc3e-4e4d-b468-6c7b46bc33a8"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#772673bc-cc3e-4e4d-b468-6c7b46bc33a8"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#772673bc-cc3e-4e4d-b468-6c7b46bc33a8"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#2805e2d9-5f42-437d-9946-ca02368992b3"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#2805e2d9-5f42-437d-9946-ca02368992b3"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#2805e2d9-5f42-437d-9946-ca02368992b3"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#2805e2d9-5f42-437d-9946-ca02368992b3"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#031b59ef-faee-4211-ba14-ff42b04b5400"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#031b59ef-faee-4211-ba14-ff42b04b5400"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#031b59ef-faee-4211-ba14-ff42b04b5400"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#031b59ef-faee-4211-ba14-ff42b04b5400"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#0077b380-579f-47e4-850d-ce2a5dfd967c"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#0077b380-579f-47e4-850d-ce2a5dfd967c"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#0077b380-579f-47e4-850d-ce2a5dfd967c"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#0077b380-579f-47e4-850d-ce2a5dfd967c"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#4082167c-50df-4572-8fb7-5f292763265e"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#4082167c-50df-4572-8fb7-5f292763265e"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#4082167c-50df-4572-8fb7-5f292763265e"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#4082167c-50df-4572-8fb7-5f292763265e"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#1fed2ce7-23fc-4448-a23e-ae69ad84151c"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#1fed2ce7-23fc-4448-a23e-ae69ad84151c"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#1fed2ce7-23fc-4448-a23e-ae69ad84151c"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#1fed2ce7-23fc-4448-a23e-ae69ad84151c"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#37cd69d0-8a17-442b-ae26-b63270307d15"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#37cd69d0-8a17-442b-ae26-b63270307d15"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#37cd69d0-8a17-442b-ae26-b63270307d15"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#37cd69d0-8a17-442b-ae26-b63270307d15"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#a9d5648d-6275-4268-83a3-698ce5fdf16d"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#a9d5648d-6275-4268-83a3-698ce5fdf16d"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#a9d5648d-6275-4268-83a3-698ce5fdf16d"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#a9d5648d-6275-4268-83a3-698ce5fdf16d"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#07a67c48-cde2-43b3-94da-ca47a526c7f5"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#07a67c48-cde2-43b3-94da-ca47a526c7f5"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#07a67c48-cde2-43b3-94da-ca47a526c7f5"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#07a67c48-cde2-43b3-94da-ca47a526c7f5"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#05c74c07-d4e8-47a5-916f-dfeb102fee06"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#05c74c07-d4e8-47a5-916f-dfeb102fee06"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#05c74c07-d4e8-47a5-916f-dfeb102fee06"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#05c74c07-d4e8-47a5-916f-dfeb102fee06"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#10816bbd-0797-4d62-86cf-856806060923"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#10816bbd-0797-4d62-86cf-856806060923"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#10816bbd-0797-4d62-86cf-856806060923"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#10816bbd-0797-4d62-86cf-856806060923"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#04db8419-4978-4458-a34e-e2f50653a407"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#04db8419-4978-4458-a34e-e2f50653a407"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#04db8419-4978-4458-a34e-e2f50653a407"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#04db8419-4978-4458-a34e-e2f50653a407"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#02171dc6-0a0b-44c2-a189-4115dcae56d9"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#02171dc6-0a0b-44c2-a189-4115dcae56d9"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#02171dc6-0a0b-44c2-a189-4115dcae56d9"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#02171dc6-0a0b-44c2-a189-4115dcae56d9"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#4916c288-7136-410d-9fca-33e8908bfb9f"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#4916c288-7136-410d-9fca-33e8908bfb9f"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#4916c288-7136-410d-9fca-33e8908bfb9f"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#4916c288-7136-410d-9fca-33e8908bfb9f"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-45536",
"source": {
"name": "ghsa",
"url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
},
"ratings": [
{
"source": {
"name": "ghsa"
},
"score": 4,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "redhat"
},
"score": 4,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
}
],
"cwes": [
200,
772
],
"description": "Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, netty_unix_socket_recvFd sets msg_control to `char control[CMSG_SPACE(sizeof(int))]` (line 940) \u2014 24 bytes on 64-bit Linux. A peer-sent SCM_RIGHTS cmsg carrying two ints has cmsg_len = CMSG_LEN(8) = 24, which fits exactly with no MSG_CTRUNC, so the kernel installs both fds in the receiving process. The subsequent check `cmsg->cmsg_len == CMSG_LEN(sizeof(int))` (line 972, expected 20) fails, the branch that would read the fd is skipped, and neither installed fd is closed. The for(;;) loop calls recvmsg again (non-blocking \u2192 EAGAIN \u2192 Java maps to 0 \u2192 read loop exits normally), leaving two leaked fds per message. There is no MSG_CTRUNC handling. Reachable via Epoll/KQueue DomainSocketChannel when the application opts into DomainSocketReadMode.FILE_DESCRIPTORS (non-default). Versions 4.1.135.Final and 4.2.15.Final patch the issue.",
"recommendation": "Upgrade io.netty:netty-transport-native-epoll to version 4.2.15.Final, 4.1.135.Final; Upgrade io.netty:netty-transport-native-kqueue to version 4.2.15.Final, 4.1.135.Final",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-45536"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-45536"
},
{
"url": "https://github.com/netty/netty"
},
{
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"url": "https://github.com/netty/netty/security/advisories/GHSA-w573-9ffj-6ff9"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45536"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45536"
}
],
"published": "2026-06-12T15:16:27+00:00",
"updated": "2026-06-15T02:14:53+00:00",
"affects": [
{
"ref": "pkg:maven/io.netty/netty-transport-native-epoll@4.1.133.Final",
"versions": [
{
"version": "4.1.133.Final",
"status": "affected"
}
]
},
{
"ref": "pkg:maven/io.netty/netty-transport-native-epoll@4.1.133.Final",
"versions": [
{
"version": "4.1.133.Final",
"status": "affected"
}
]
},
{
"ref": "pkg:maven/io.netty/netty-transport-native-kqueue@4.1.133.Final",
"versions": [
{
"version": "4.1.133.Final",
"status": "affected"
}
]
},
{
"ref": "pkg:maven/io.netty/netty-transport-native-kqueue@4.1.133.Final",
"versions": [
{
"version": "4.1.133.Final",
"status": "affected"
}
]
},
{
"ref": "pkg:maven/io.netty/netty-transport-native-epoll@4.1.133.Final",
"versions": [
{
"version": "4.1.133.Final",
"status": "affected"
}
]
},
{
"ref": "pkg:maven/io.netty/netty-transport-native-kqueue@4.1.133.Final",
"versions": [
{
"version": "4.1.133.Final",
"status": "affected"
}
]
},
{
"ref": "pkg:maven/io.netty/netty-transport-native-epoll@4.1.133.Final",
"versions": [
{
"version": "4.1.133.Final",
"status": "affected"
}
]
},
{
"ref": "pkg:maven/io.netty/netty-transport-native-kqueue@4.1.133.Final",
"versions": [
{
"version": "4.1.133.Final",
"status": "affected"
}
]
},
{
"ref": "pkg:maven/io.netty/netty-transport-native-kqueue@4.1.133.Final",
"versions": [
{
"version": "4.1.133.Final",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#22ea93a5-d379-4fe5-89ef-e46367a2bfe8"
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#22ea93a5-d379-4fe5-89ef-e46367a2bfe8"
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#2e1d0bbb-2e80-4007-8e1b-ebff0d58412e"
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#2e1d0bbb-2e80-4007-8e1b-ebff0d58412e"
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#22ea93a5-d379-4fe5-89ef-e46367a2bfe8"
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#2e1d0bbb-2e80-4007-8e1b-ebff0d58412e"
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#22ea93a5-d379-4fe5-89ef-e46367a2bfe8"
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#2e1d0bbb-2e80-4007-8e1b-ebff0d58412e"
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#2e1d0bbb-2e80-4007-8e1b-ebff0d58412e"
},
{
"ref": "urn:cdx:605c4cf6-768c-4740-88af-644c86949366/1#71ee1fcb-dcf3-4926-b21b-6d78f190d18f"
},
{
"ref": "urn:cdx:605c4cf6-768c-4740-88af-644c86949366/1#71ee1fcb-dcf3-4926-b21b-6d78f190d18f"
},
{
"ref": "urn:cdx:605c4cf6-768c-4740-88af-644c86949366/1#522427a1-b4c1-4328-a08d-07cbc7dbea8e"
},
{
"ref": "urn:cdx:605c4cf6-768c-4740-88af-644c86949366/1#522427a1-b4c1-4328-a08d-07cbc7dbea8e"
},
{
"ref": "urn:cdx:605c4cf6-768c-4740-88af-644c86949366/1#71ee1fcb-dcf3-4926-b21b-6d78f190d18f"
},
{
"ref": "urn:cdx:605c4cf6-768c-4740-88af-644c86949366/1#522427a1-b4c1-4328-a08d-07cbc7dbea8e"
},
{
"ref": "urn:cdx:605c4cf6-768c-4740-88af-644c86949366/1#71ee1fcb-dcf3-4926-b21b-6d78f190d18f"
},
{
"ref": "urn:cdx:605c4cf6-768c-4740-88af-644c86949366/1#522427a1-b4c1-4328-a08d-07cbc7dbea8e"
},
{
"ref": "urn:cdx:605c4cf6-768c-4740-88af-644c86949366/1#522427a1-b4c1-4328-a08d-07cbc7dbea8e"
},
{
"ref": "urn:cdx:5edaa6b5-97a5-4cb5-86fd-5c8da204e917/1#00fcedfa-6e58-492e-a4f4-880c6e3fedc3"
},
{
"ref": "urn:cdx:5edaa6b5-97a5-4cb5-86fd-5c8da204e917/1#00fcedfa-6e58-492e-a4f4-880c6e3fedc3"
},
{
"ref": "urn:cdx:5edaa6b5-97a5-4cb5-86fd-5c8da204e917/1#9713758a-298c-439c-b902-bad270060d0e"
},
{
"ref": "urn:cdx:5edaa6b5-97a5-4cb5-86fd-5c8da204e917/1#9713758a-298c-439c-b902-bad270060d0e"
},
{
"ref": "urn:cdx:5edaa6b5-97a5-4cb5-86fd-5c8da204e917/1#00fcedfa-6e58-492e-a4f4-880c6e3fedc3"
},
{
"ref": "urn:cdx:5edaa6b5-97a5-4cb5-86fd-5c8da204e917/1#9713758a-298c-439c-b902-bad270060d0e"
},
{
"ref": "urn:cdx:5edaa6b5-97a5-4cb5-86fd-5c8da204e917/1#00fcedfa-6e58-492e-a4f4-880c6e3fedc3"
},
{
"ref": "urn:cdx:5edaa6b5-97a5-4cb5-86fd-5c8da204e917/1#9713758a-298c-439c-b902-bad270060d0e"
},
{
"ref": "urn:cdx:5edaa6b5-97a5-4cb5-86fd-5c8da204e917/1#9713758a-298c-439c-b902-bad270060d0e"
},
{
"ref": "urn:cdx:00efd76e-fc8f-48fa-a71d-c9d70b5f9447/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.133.Final"
},
{
"ref": "urn:cdx:00efd76e-fc8f-48fa-a71d-c9d70b5f9447/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.133.Final"
},
{
"ref": "urn:cdx:00efd76e-fc8f-48fa-a71d-c9d70b5f9447/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.133.Final"
},
{
"ref": "urn:cdx:00efd76e-fc8f-48fa-a71d-c9d70b5f9447/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.133.Final"
},
{
"ref": "urn:cdx:5c15d8a3-b4c2-4b3e-942e-57b2854d6d7c/1#28d6fecc-3466-4aef-bdf2-aec223bc8b93"
},
{
"ref": "urn:cdx:5c15d8a3-b4c2-4b3e-942e-57b2854d6d7c/1#28d6fecc-3466-4aef-bdf2-aec223bc8b93"
},
{
"ref": "urn:cdx:5c15d8a3-b4c2-4b3e-942e-57b2854d6d7c/1#03d73987-8600-4d83-98c0-baa45b56e1a3"
},
{
"ref": "urn:cdx:5c15d8a3-b4c2-4b3e-942e-57b2854d6d7c/1#03d73987-8600-4d83-98c0-baa45b56e1a3"
},
{
"ref": "urn:cdx:5c15d8a3-b4c2-4b3e-942e-57b2854d6d7c/1#28d6fecc-3466-4aef-bdf2-aec223bc8b93"
},
{
"ref": "urn:cdx:5c15d8a3-b4c2-4b3e-942e-57b2854d6d7c/1#03d73987-8600-4d83-98c0-baa45b56e1a3"
},
{
"ref": "urn:cdx:5c15d8a3-b4c2-4b3e-942e-57b2854d6d7c/1#28d6fecc-3466-4aef-bdf2-aec223bc8b93"
},
{
"ref": "urn:cdx:5c15d8a3-b4c2-4b3e-942e-57b2854d6d7c/1#03d73987-8600-4d83-98c0-baa45b56e1a3"
},
{
"ref": "urn:cdx:5c15d8a3-b4c2-4b3e-942e-57b2854d6d7c/1#03d73987-8600-4d83-98c0-baa45b56e1a3"
},
{
"ref": "urn:cdx:1984c021-252b-4038-b5c2-7dc58cdccb34/1#0bf91f34-78bb-4fe0-9cf0-a965df1f7789"
},
{
"ref": "urn:cdx:1984c021-252b-4038-b5c2-7dc58cdccb34/1#0bf91f34-78bb-4fe0-9cf0-a965df1f7789"
},
{
"ref": "urn:cdx:1984c021-252b-4038-b5c2-7dc58cdccb34/1#0edad912-fdb1-49d9-9873-0b3c6e56fdc8"
},
{
"ref": "urn:cdx:1984c021-252b-4038-b5c2-7dc58cdccb34/1#0edad912-fdb1-49d9-9873-0b3c6e56fdc8"
},
{
"ref": "urn:cdx:1984c021-252b-4038-b5c2-7dc58cdccb34/1#0bf91f34-78bb-4fe0-9cf0-a965df1f7789"
},
{
"ref": "urn:cdx:1984c021-252b-4038-b5c2-7dc58cdccb34/1#0edad912-fdb1-49d9-9873-0b3c6e56fdc8"
},
{
"ref": "urn:cdx:1984c021-252b-4038-b5c2-7dc58cdccb34/1#0bf91f34-78bb-4fe0-9cf0-a965df1f7789"
},
{
"ref": "urn:cdx:1984c021-252b-4038-b5c2-7dc58cdccb34/1#0edad912-fdb1-49d9-9873-0b3c6e56fdc8"
},
{
"ref": "urn:cdx:1984c021-252b-4038-b5c2-7dc58cdccb34/1#0edad912-fdb1-49d9-9873-0b3c6e56fdc8"
},
{
"ref": "urn:cdx:c04a5fc7-a5fb-4f38-bfed-0fa15f9fd95f/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.133.Final"
},
{
"ref": "urn:cdx:c04a5fc7-a5fb-4f38-bfed-0fa15f9fd95f/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.133.Final"
},
{
"ref": "urn:cdx:c04a5fc7-a5fb-4f38-bfed-0fa15f9fd95f/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.133.Final"
},
{
"ref": "urn:cdx:c04a5fc7-a5fb-4f38-bfed-0fa15f9fd95f/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.133.Final"
},
{
"ref": "urn:cdx:d9316630-0b4e-424a-9b57-0891facfdb48/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.133.Final"
},
{
"ref": "urn:cdx:d9316630-0b4e-424a-9b57-0891facfdb48/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.133.Final"
},
{
"ref": "urn:cdx:d9316630-0b4e-424a-9b57-0891facfdb48/1#pkg:maven/io.netty/netty-transport-native-kqueue@4.1.133.Final"
},
{
"ref": "urn:cdx:d9316630-0b4e-424a-9b57-0891facfdb48/1#pkg:maven/io.netty/netty-transport-native-kqueue@4.1.133.Final"
},
{
"ref": "urn:cdx:d9316630-0b4e-424a-9b57-0891facfdb48/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.133.Final"
},
{
"ref": "urn:cdx:d9316630-0b4e-424a-9b57-0891facfdb48/1#pkg:maven/io.netty/netty-transport-native-kqueue@4.1.133.Final"
},
{
"ref": "urn:cdx:d9316630-0b4e-424a-9b57-0891facfdb48/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.133.Final"
},
{
"ref": "urn:cdx:d9316630-0b4e-424a-9b57-0891facfdb48/1#pkg:maven/io.netty/netty-transport-native-kqueue@4.1.133.Final"
},
{
"ref": "urn:cdx:d9316630-0b4e-424a-9b57-0891facfdb48/1#pkg:maven/io.netty/netty-transport-native-kqueue@4.1.133.Final"
},
{
"ref": "urn:cdx:b5e3ea0e-3953-4d71-9f97-b04d97cc22f4/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.133.Final"
},
{
"ref": "urn:cdx:b5e3ea0e-3953-4d71-9f97-b04d97cc22f4/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.133.Final"
},
{
"ref": "urn:cdx:b5e3ea0e-3953-4d71-9f97-b04d97cc22f4/1#pkg:maven/io.netty/netty-transport-native-kqueue@4.1.133.Final"
},
{
"ref": "urn:cdx:b5e3ea0e-3953-4d71-9f97-b04d97cc22f4/1#pkg:maven/io.netty/netty-transport-native-kqueue@4.1.133.Final"
},
{
"ref": "urn:cdx:b5e3ea0e-3953-4d71-9f97-b04d97cc22f4/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.133.Final"
},
{
"ref": "urn:cdx:b5e3ea0e-3953-4d71-9f97-b04d97cc22f4/1#pkg:maven/io.netty/netty-transport-native-kqueue@4.1.133.Final"
},
{
"ref": "urn:cdx:b5e3ea0e-3953-4d71-9f97-b04d97cc22f4/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.133.Final"
},
{
"ref": "urn:cdx:b5e3ea0e-3953-4d71-9f97-b04d97cc22f4/1#pkg:maven/io.netty/netty-transport-native-kqueue@4.1.133.Final"
},
{
"ref": "urn:cdx:b5e3ea0e-3953-4d71-9f97-b04d97cc22f4/1#pkg:maven/io.netty/netty-transport-native-kqueue@4.1.133.Final"
},
{
"ref": "urn:cdx:0bc95285-afe2-4a8c-b014-7ea60e19327f/1#1424569c-6de9-403d-a05f-8d76d67e3268"
},
{
"ref": "urn:cdx:0bc95285-afe2-4a8c-b014-7ea60e19327f/1#1424569c-6de9-403d-a05f-8d76d67e3268"
},
{
"ref": "urn:cdx:0bc95285-afe2-4a8c-b014-7ea60e19327f/1#41a437c2-8588-4275-bffa-f740db54356e"
},
{
"ref": "urn:cdx:0bc95285-afe2-4a8c-b014-7ea60e19327f/1#41a437c2-8588-4275-bffa-f740db54356e"
},
{
"ref": "urn:cdx:0bc95285-afe2-4a8c-b014-7ea60e19327f/1#1424569c-6de9-403d-a05f-8d76d67e3268"
},
{
"ref": "urn:cdx:0bc95285-afe2-4a8c-b014-7ea60e19327f/1#41a437c2-8588-4275-bffa-f740db54356e"
},
{
"ref": "urn:cdx:0bc95285-afe2-4a8c-b014-7ea60e19327f/1#1424569c-6de9-403d-a05f-8d76d67e3268"
},
{
"ref": "urn:cdx:0bc95285-afe2-4a8c-b014-7ea60e19327f/1#41a437c2-8588-4275-bffa-f740db54356e"
},
{
"ref": "urn:cdx:0bc95285-afe2-4a8c-b014-7ea60e19327f/1#41a437c2-8588-4275-bffa-f740db54356e"
},
{
"ref": "urn:cdx:32a0fc77-dccf-43c8-8d4e-779797d168d8/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.133.Final"
},
{
"ref": "urn:cdx:32a0fc77-dccf-43c8-8d4e-779797d168d8/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.133.Final"
},
{
"ref": "urn:cdx:32a0fc77-dccf-43c8-8d4e-779797d168d8/1#pkg:maven/io.netty/netty-transport-native-kqueue@4.1.133.Final"
},
{
"ref": "urn:cdx:32a0fc77-dccf-43c8-8d4e-779797d168d8/1#pkg:maven/io.netty/netty-transport-native-kqueue@4.1.133.Final"
},
{
"ref": "urn:cdx:32a0fc77-dccf-43c8-8d4e-779797d168d8/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.133.Final"
},
{
"ref": "urn:cdx:32a0fc77-dccf-43c8-8d4e-779797d168d8/1#pkg:maven/io.netty/netty-transport-native-kqueue@4.1.133.Final"
},
{
"ref": "urn:cdx:32a0fc77-dccf-43c8-8d4e-779797d168d8/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.133.Final"
},
{
"ref": "urn:cdx:32a0fc77-dccf-43c8-8d4e-779797d168d8/1#pkg:maven/io.netty/netty-transport-native-kqueue@4.1.133.Final"
},
{
"ref": "urn:cdx:32a0fc77-dccf-43c8-8d4e-779797d168d8/1#pkg:maven/io.netty/netty-transport-native-kqueue@4.1.133.Final"
},
{
"ref": "urn:cdx:9248c11a-a6c2-4e62-9a2e-7f374f557cd6/1#44cef088-de61-46a5-90fd-835d5ea0c465"
},
{
"ref": "urn:cdx:9248c11a-a6c2-4e62-9a2e-7f374f557cd6/1#44cef088-de61-46a5-90fd-835d5ea0c465"
},
{
"ref": "urn:cdx:9248c11a-a6c2-4e62-9a2e-7f374f557cd6/1#66fd626b-6272-4ce0-88c0-a951c32202e3"
},
{
"ref": "urn:cdx:9248c11a-a6c2-4e62-9a2e-7f374f557cd6/1#66fd626b-6272-4ce0-88c0-a951c32202e3"
},
{
"ref": "urn:cdx:9248c11a-a6c2-4e62-9a2e-7f374f557cd6/1#44cef088-de61-46a5-90fd-835d5ea0c465"
},
{
"ref": "urn:cdx:9248c11a-a6c2-4e62-9a2e-7f374f557cd6/1#66fd626b-6272-4ce0-88c0-a951c32202e3"
},
{
"ref": "urn:cdx:9248c11a-a6c2-4e62-9a2e-7f374f557cd6/1#44cef088-de61-46a5-90fd-835d5ea0c465"
},
{
"ref": "urn:cdx:9248c11a-a6c2-4e62-9a2e-7f374f557cd6/1#66fd626b-6272-4ce0-88c0-a951c32202e3"
},
{
"ref": "urn:cdx:9248c11a-a6c2-4e62-9a2e-7f374f557cd6/1#66fd626b-6272-4ce0-88c0-a951c32202e3"
},
{
"ref": "urn:cdx:41ca6524-f05d-4db2-91ba-d967a3eecf30/1#87c8c046-824a-44dc-846d-56a12617ac9b"
},
{
"ref": "urn:cdx:41ca6524-f05d-4db2-91ba-d967a3eecf30/1#87c8c046-824a-44dc-846d-56a12617ac9b"
},
{
"ref": "urn:cdx:41ca6524-f05d-4db2-91ba-d967a3eecf30/1#0b40fb94-be3c-4f85-8244-46945d816a5f"
},
{
"ref": "urn:cdx:41ca6524-f05d-4db2-91ba-d967a3eecf30/1#0b40fb94-be3c-4f85-8244-46945d816a5f"
},
{
"ref": "urn:cdx:41ca6524-f05d-4db2-91ba-d967a3eecf30/1#87c8c046-824a-44dc-846d-56a12617ac9b"
},
{
"ref": "urn:cdx:41ca6524-f05d-4db2-91ba-d967a3eecf30/1#0b40fb94-be3c-4f85-8244-46945d816a5f"
},
{
"ref": "urn:cdx:41ca6524-f05d-4db2-91ba-d967a3eecf30/1#87c8c046-824a-44dc-846d-56a12617ac9b"
},
{
"ref": "urn:cdx:41ca6524-f05d-4db2-91ba-d967a3eecf30/1#0b40fb94-be3c-4f85-8244-46945d816a5f"
},
{
"ref": "urn:cdx:41ca6524-f05d-4db2-91ba-d967a3eecf30/1#0b40fb94-be3c-4f85-8244-46945d816a5f"
},
{
"ref": "urn:cdx:d3b561a2-679f-4ee3-9e2d-46972f27bfa5/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.133.Final"
},
{
"ref": "urn:cdx:d3b561a2-679f-4ee3-9e2d-46972f27bfa5/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.133.Final"
},
{
"ref": "urn:cdx:d3b561a2-679f-4ee3-9e2d-46972f27bfa5/1#pkg:maven/io.netty/netty-transport-native-kqueue@4.1.133.Final"
},
{
"ref": "urn:cdx:d3b561a2-679f-4ee3-9e2d-46972f27bfa5/1#pkg:maven/io.netty/netty-transport-native-kqueue@4.1.133.Final"
},
{
"ref": "urn:cdx:d3b561a2-679f-4ee3-9e2d-46972f27bfa5/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.133.Final"
},
{
"ref": "urn:cdx:d3b561a2-679f-4ee3-9e2d-46972f27bfa5/1#pkg:maven/io.netty/netty-transport-native-kqueue@4.1.133.Final"
},
{
"ref": "urn:cdx:d3b561a2-679f-4ee3-9e2d-46972f27bfa5/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.133.Final"
},
{
"ref": "urn:cdx:d3b561a2-679f-4ee3-9e2d-46972f27bfa5/1#pkg:maven/io.netty/netty-transport-native-kqueue@4.1.133.Final"
},
{
"ref": "urn:cdx:d3b561a2-679f-4ee3-9e2d-46972f27bfa5/1#pkg:maven/io.netty/netty-transport-native-kqueue@4.1.133.Final"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#17da05ec-5fb4-4bb0-9b32-b22101121d6f"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#17da05ec-5fb4-4bb0-9b32-b22101121d6f"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#17da05ec-5fb4-4bb0-9b32-b22101121d6f"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#17da05ec-5fb4-4bb0-9b32-b22101121d6f"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#0934845a-3710-41ac-ba5e-5d5978c933b0"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#0934845a-3710-41ac-ba5e-5d5978c933b0"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#1f3b20af-c118-4a55-8cb6-e54a29b0404e"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#1f3b20af-c118-4a55-8cb6-e54a29b0404e"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#0934845a-3710-41ac-ba5e-5d5978c933b0"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#1f3b20af-c118-4a55-8cb6-e54a29b0404e"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#0934845a-3710-41ac-ba5e-5d5978c933b0"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#1f3b20af-c118-4a55-8cb6-e54a29b0404e"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#1f3b20af-c118-4a55-8cb6-e54a29b0404e"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#3a5ca662-4549-4611-854a-419f4aace597"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#3a5ca662-4549-4611-854a-419f4aace597"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#0957d103-4a18-49ef-a366-fbdcf106646b"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#0957d103-4a18-49ef-a366-fbdcf106646b"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#3a5ca662-4549-4611-854a-419f4aace597"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#0957d103-4a18-49ef-a366-fbdcf106646b"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#3a5ca662-4549-4611-854a-419f4aace597"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#0957d103-4a18-49ef-a366-fbdcf106646b"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#0957d103-4a18-49ef-a366-fbdcf106646b"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#12dc007e-7a84-4874-8233-af1ced0469a4"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#12dc007e-7a84-4874-8233-af1ced0469a4"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#0c36f6dd-cc10-40bd-9833-d46a877cad81"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#0c36f6dd-cc10-40bd-9833-d46a877cad81"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#12dc007e-7a84-4874-8233-af1ced0469a4"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#0c36f6dd-cc10-40bd-9833-d46a877cad81"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#12dc007e-7a84-4874-8233-af1ced0469a4"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#0c36f6dd-cc10-40bd-9833-d46a877cad81"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#0c36f6dd-cc10-40bd-9833-d46a877cad81"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#1c49a74a-3bed-4d3d-859d-8b88ee3c1cc5"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#1c49a74a-3bed-4d3d-859d-8b88ee3c1cc5"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#0955f854-c000-4e20-8602-7665a16c8214"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#0955f854-c000-4e20-8602-7665a16c8214"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#1c49a74a-3bed-4d3d-859d-8b88ee3c1cc5"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#0955f854-c000-4e20-8602-7665a16c8214"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#1c49a74a-3bed-4d3d-859d-8b88ee3c1cc5"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#0955f854-c000-4e20-8602-7665a16c8214"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#0955f854-c000-4e20-8602-7665a16c8214"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.133.Final"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.133.Final"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.133.Final"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.133.Final"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#021cc9ac-79ce-4ba4-939d-92add5b787e2"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#021cc9ac-79ce-4ba4-939d-92add5b787e2"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#3a39bcef-e5b8-40b5-887f-f7e330d51352"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#3a39bcef-e5b8-40b5-887f-f7e330d51352"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#021cc9ac-79ce-4ba4-939d-92add5b787e2"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#3a39bcef-e5b8-40b5-887f-f7e330d51352"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#021cc9ac-79ce-4ba4-939d-92add5b787e2"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#3a39bcef-e5b8-40b5-887f-f7e330d51352"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#3a39bcef-e5b8-40b5-887f-f7e330d51352"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#210bb7c0-e097-4546-93c1-2b219053d8d3"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#210bb7c0-e097-4546-93c1-2b219053d8d3"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#25e9b6c7-c00d-45b8-bdff-4558c577a31a"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#25e9b6c7-c00d-45b8-bdff-4558c577a31a"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#210bb7c0-e097-4546-93c1-2b219053d8d3"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#25e9b6c7-c00d-45b8-bdff-4558c577a31a"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#210bb7c0-e097-4546-93c1-2b219053d8d3"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#25e9b6c7-c00d-45b8-bdff-4558c577a31a"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#25e9b6c7-c00d-45b8-bdff-4558c577a31a"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#0095f8fa-7037-44b3-b9a5-d04c9f082203"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#0095f8fa-7037-44b3-b9a5-d04c9f082203"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#301729f5-1186-4508-9c1c-6abf79a4d366"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#301729f5-1186-4508-9c1c-6abf79a4d366"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#0095f8fa-7037-44b3-b9a5-d04c9f082203"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#301729f5-1186-4508-9c1c-6abf79a4d366"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#0095f8fa-7037-44b3-b9a5-d04c9f082203"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#301729f5-1186-4508-9c1c-6abf79a4d366"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#301729f5-1186-4508-9c1c-6abf79a4d366"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#07edff80-825c-4445-aafe-974c50b3d33d"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#07edff80-825c-4445-aafe-974c50b3d33d"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#0353ae98-24e8-4cd1-8777-1492e469b552"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#0353ae98-24e8-4cd1-8777-1492e469b552"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#07edff80-825c-4445-aafe-974c50b3d33d"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#0353ae98-24e8-4cd1-8777-1492e469b552"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#07edff80-825c-4445-aafe-974c50b3d33d"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#0353ae98-24e8-4cd1-8777-1492e469b552"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#0353ae98-24e8-4cd1-8777-1492e469b552"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.133.Final"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.133.Final"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:maven/io.netty/netty-transport-native-kqueue@4.1.133.Final"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:maven/io.netty/netty-transport-native-kqueue@4.1.133.Final"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.133.Final"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:maven/io.netty/netty-transport-native-kqueue@4.1.133.Final"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.133.Final"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:maven/io.netty/netty-transport-native-kqueue@4.1.133.Final"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:maven/io.netty/netty-transport-native-kqueue@4.1.133.Final"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#1ff0d697-28cb-48ca-9e8d-4a5a8b96580b"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#1ff0d697-28cb-48ca-9e8d-4a5a8b96580b"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#07658464-57d0-487e-ba43-f20f896be370"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#07658464-57d0-487e-ba43-f20f896be370"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#1ff0d697-28cb-48ca-9e8d-4a5a8b96580b"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#07658464-57d0-487e-ba43-f20f896be370"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#1ff0d697-28cb-48ca-9e8d-4a5a8b96580b"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#07658464-57d0-487e-ba43-f20f896be370"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#07658464-57d0-487e-ba43-f20f896be370"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#028a97b2-713e-4b07-87d4-d4ae607a3fc4"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#028a97b2-713e-4b07-87d4-d4ae607a3fc4"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#086241a4-a718-4ed9-a1a9-031439bc06c5"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#086241a4-a718-4ed9-a1a9-031439bc06c5"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#028a97b2-713e-4b07-87d4-d4ae607a3fc4"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#086241a4-a718-4ed9-a1a9-031439bc06c5"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#028a97b2-713e-4b07-87d4-d4ae607a3fc4"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#086241a4-a718-4ed9-a1a9-031439bc06c5"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#086241a4-a718-4ed9-a1a9-031439bc06c5"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#0e8a787b-8c6b-4f06-8480-8e7ac3ee0d9b"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#0e8a787b-8c6b-4f06-8480-8e7ac3ee0d9b"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#1569d7c7-2246-471b-a9cb-a27ce9ed7e9d"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#1569d7c7-2246-471b-a9cb-a27ce9ed7e9d"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#0e8a787b-8c6b-4f06-8480-8e7ac3ee0d9b"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#1569d7c7-2246-471b-a9cb-a27ce9ed7e9d"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#0e8a787b-8c6b-4f06-8480-8e7ac3ee0d9b"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#1569d7c7-2246-471b-a9cb-a27ce9ed7e9d"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#1569d7c7-2246-471b-a9cb-a27ce9ed7e9d"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#099e0b21-ac8c-4a5e-a31f-028e14d536bf"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#099e0b21-ac8c-4a5e-a31f-028e14d536bf"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#00e8a47b-0c12-4f98-a51a-5306803925a2"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#00e8a47b-0c12-4f98-a51a-5306803925a2"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#099e0b21-ac8c-4a5e-a31f-028e14d536bf"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#00e8a47b-0c12-4f98-a51a-5306803925a2"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#099e0b21-ac8c-4a5e-a31f-028e14d536bf"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#00e8a47b-0c12-4f98-a51a-5306803925a2"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#00e8a47b-0c12-4f98-a51a-5306803925a2"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#13901388-9d3d-40a1-ac4e-48dda84ec98d"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#13901388-9d3d-40a1-ac4e-48dda84ec98d"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#0247a9df-fa22-451b-b9de-e86efdeac868"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#0247a9df-fa22-451b-b9de-e86efdeac868"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#13901388-9d3d-40a1-ac4e-48dda84ec98d"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#0247a9df-fa22-451b-b9de-e86efdeac868"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#13901388-9d3d-40a1-ac4e-48dda84ec98d"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#0247a9df-fa22-451b-b9de-e86efdeac868"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#0247a9df-fa22-451b-b9de-e86efdeac868"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.133.Final"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.133.Final"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.133.Final"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:maven/io.netty/netty-transport-native-epoll@4.1.133.Final"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#47fc787e-773f-4c02-8c52-692f4e67c3b2"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#47fc787e-773f-4c02-8c52-692f4e67c3b2"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#02bddeaf-8ece-4c7d-8fe1-76ef76b8352c"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#02bddeaf-8ece-4c7d-8fe1-76ef76b8352c"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#47fc787e-773f-4c02-8c52-692f4e67c3b2"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#02bddeaf-8ece-4c7d-8fe1-76ef76b8352c"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#47fc787e-773f-4c02-8c52-692f4e67c3b2"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#02bddeaf-8ece-4c7d-8fe1-76ef76b8352c"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#02bddeaf-8ece-4c7d-8fe1-76ef76b8352c"
}
],
"analysis": {
"state": "in_triage",
"justification": "",
"response": [],
"detail": "This CVE is under investigation by Confluent."
}
},
{
"id": "CVE-2026-45673",
"source": {
"name": "ghsa",
"url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
},
"ratings": [
{
"source": {
"name": "ghsa"
},
"score": 6.8,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N"
},
{
"source": {
"name": "redhat"
},
"score": 6.8,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N"
}
],
"cwes": [
330,
340
],
"description": "Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DNS resolver uses a predictable PRNG for generating DNS transaction IDs and defaults to a static UDP source port. This combination reduces the entropy of DNS queries, enabling DNS Cache Poisoning (Kaminsky attack). Versions 4.1.135.Final and 4.2.15.Final patch the issue.",
"recommendation": "Upgrade io.netty:netty-resolver-dns to version 4.2.15.Final, 4.1.135.Final",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-45673"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-45673"
},
{
"url": "https://github.com/netty/netty"
},
{
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"url": "https://github.com/netty/netty/security/advisories/GHSA-xmv7-r254-6q78"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45673"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45673"
}
],
"published": "2026-06-12T15:16:27+00:00",
"updated": "2026-06-15T02:14:01+00:00",
"affects": [
{
"ref": "pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final",
"versions": [
{
"version": "4.1.133.Final",
"status": "affected"
}
]
},
{
"ref": "pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final",
"versions": [
{
"version": "4.1.133.Final",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#11b2c4dd-dbd5-4309-9f11-6546378f1dbd"
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#11b2c4dd-dbd5-4309-9f11-6546378f1dbd"
},
{
"ref": "urn:cdx:605c4cf6-768c-4740-88af-644c86949366/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:605c4cf6-768c-4740-88af-644c86949366/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:5edaa6b5-97a5-4cb5-86fd-5c8da204e917/1#35c0cd5b-8c74-4699-92eb-f58f4e275044"
},
{
"ref": "urn:cdx:5edaa6b5-97a5-4cb5-86fd-5c8da204e917/1#35c0cd5b-8c74-4699-92eb-f58f4e275044"
},
{
"ref": "urn:cdx:5c15d8a3-b4c2-4b3e-942e-57b2854d6d7c/1#45ac735a-3ca6-4c14-85a7-62d2bb2523c0"
},
{
"ref": "urn:cdx:5c15d8a3-b4c2-4b3e-942e-57b2854d6d7c/1#45ac735a-3ca6-4c14-85a7-62d2bb2523c0"
},
{
"ref": "urn:cdx:1984c021-252b-4038-b5c2-7dc58cdccb34/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:1984c021-252b-4038-b5c2-7dc58cdccb34/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:d9316630-0b4e-424a-9b57-0891facfdb48/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:d9316630-0b4e-424a-9b57-0891facfdb48/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:0bc95285-afe2-4a8c-b014-7ea60e19327f/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:0bc95285-afe2-4a8c-b014-7ea60e19327f/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:32a0fc77-dccf-43c8-8d4e-779797d168d8/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:32a0fc77-dccf-43c8-8d4e-779797d168d8/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:9248c11a-a6c2-4e62-9a2e-7f374f557cd6/1#dd5bbd80-bc04-4051-8f3f-aa9392aff627"
},
{
"ref": "urn:cdx:9248c11a-a6c2-4e62-9a2e-7f374f557cd6/1#dd5bbd80-bc04-4051-8f3f-aa9392aff627"
},
{
"ref": "urn:cdx:41ca6524-f05d-4db2-91ba-d967a3eecf30/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:41ca6524-f05d-4db2-91ba-d967a3eecf30/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#532eeb32-679a-4d60-96a7-f8fa6f7ae2a3"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#532eeb32-679a-4d60-96a7-f8fa6f7ae2a3"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#14abf70f-ee21-4375-bbad-5ac81bb2f25d"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#14abf70f-ee21-4375-bbad-5ac81bb2f25d"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#14c3ac2c-b69c-4149-80ec-530ccf2e8d62"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#14c3ac2c-b69c-4149-80ec-530ccf2e8d62"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#22b2b37a-6a03-4de7-b27c-0f94d17f3bfa"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#22b2b37a-6a03-4de7-b27c-0f94d17f3bfa"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#665eeaa0-cc96-417e-9837-62efb76e7c59"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#665eeaa0-cc96-417e-9837-62efb76e7c59"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#08c5dec2-99a0-4adc-a4f4-940ce1b89c50"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#08c5dec2-99a0-4adc-a4f4-940ce1b89c50"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#2baef862-9591-4070-938e-c0194a73ae99"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#2baef862-9591-4070-938e-c0194a73ae99"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#27a44580-d07e-42f0-bb0f-f4381a21fa7d"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#27a44580-d07e-42f0-bb0f-f4381a21fa7d"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#6117f995-5769-48d1-980f-96cf7f48e304"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#6117f995-5769-48d1-980f-96cf7f48e304"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#029a7127-e7b0-49fd-8286-e5285322b2e2"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#029a7127-e7b0-49fd-8286-e5285322b2e2"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#0834a141-8c1a-4742-938b-f78578a0f772"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#0834a141-8c1a-4742-938b-f78578a0f772"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#11797bd2-0df6-4348-bb7f-f47034823811"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#11797bd2-0df6-4348-bb7f-f47034823811"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-45674",
"source": {
"name": "ghsa",
"url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
},
"ratings": [
{
"source": {
"name": "ghsa"
},
"score": 8.7,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N"
},
{
"source": {
"name": "nvd"
},
"score": 10,
"severity": "critical",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N"
},
{
"source": {
"name": "redhat"
},
"score": 8.7,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N"
}
],
"cwes": [
345
],
"description": "Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. Versions 4.1.135.Final and 4.2.15.Final patch the issue.",
"recommendation": "Upgrade io.netty:netty-resolver-dns to version 4.2.15.Final, 4.1.135.Final",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-45674"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-45674"
},
{
"url": "https://github.com/netty/netty"
},
{
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"url": "https://github.com/netty/netty/security/advisories/GHSA-676x-f7gg-47vc"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45674"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45674"
}
],
"published": "2026-06-12T15:16:27+00:00",
"updated": "2026-06-15T02:13:07+00:00",
"affects": [
{
"ref": "pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final",
"versions": [
{
"version": "4.1.133.Final",
"status": "affected"
}
]
},
{
"ref": "pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final",
"versions": [
{
"version": "4.1.133.Final",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#11b2c4dd-dbd5-4309-9f11-6546378f1dbd"
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#11b2c4dd-dbd5-4309-9f11-6546378f1dbd"
},
{
"ref": "urn:cdx:605c4cf6-768c-4740-88af-644c86949366/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:605c4cf6-768c-4740-88af-644c86949366/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:5edaa6b5-97a5-4cb5-86fd-5c8da204e917/1#35c0cd5b-8c74-4699-92eb-f58f4e275044"
},
{
"ref": "urn:cdx:5edaa6b5-97a5-4cb5-86fd-5c8da204e917/1#35c0cd5b-8c74-4699-92eb-f58f4e275044"
},
{
"ref": "urn:cdx:5c15d8a3-b4c2-4b3e-942e-57b2854d6d7c/1#45ac735a-3ca6-4c14-85a7-62d2bb2523c0"
},
{
"ref": "urn:cdx:5c15d8a3-b4c2-4b3e-942e-57b2854d6d7c/1#45ac735a-3ca6-4c14-85a7-62d2bb2523c0"
},
{
"ref": "urn:cdx:1984c021-252b-4038-b5c2-7dc58cdccb34/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:1984c021-252b-4038-b5c2-7dc58cdccb34/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:d9316630-0b4e-424a-9b57-0891facfdb48/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:d9316630-0b4e-424a-9b57-0891facfdb48/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:0bc95285-afe2-4a8c-b014-7ea60e19327f/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:0bc95285-afe2-4a8c-b014-7ea60e19327f/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:32a0fc77-dccf-43c8-8d4e-779797d168d8/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:32a0fc77-dccf-43c8-8d4e-779797d168d8/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:9248c11a-a6c2-4e62-9a2e-7f374f557cd6/1#dd5bbd80-bc04-4051-8f3f-aa9392aff627"
},
{
"ref": "urn:cdx:9248c11a-a6c2-4e62-9a2e-7f374f557cd6/1#dd5bbd80-bc04-4051-8f3f-aa9392aff627"
},
{
"ref": "urn:cdx:41ca6524-f05d-4db2-91ba-d967a3eecf30/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:41ca6524-f05d-4db2-91ba-d967a3eecf30/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#532eeb32-679a-4d60-96a7-f8fa6f7ae2a3"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#532eeb32-679a-4d60-96a7-f8fa6f7ae2a3"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#14abf70f-ee21-4375-bbad-5ac81bb2f25d"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#14abf70f-ee21-4375-bbad-5ac81bb2f25d"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#14c3ac2c-b69c-4149-80ec-530ccf2e8d62"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#14c3ac2c-b69c-4149-80ec-530ccf2e8d62"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#22b2b37a-6a03-4de7-b27c-0f94d17f3bfa"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#22b2b37a-6a03-4de7-b27c-0f94d17f3bfa"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#665eeaa0-cc96-417e-9837-62efb76e7c59"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#665eeaa0-cc96-417e-9837-62efb76e7c59"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#08c5dec2-99a0-4adc-a4f4-940ce1b89c50"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#08c5dec2-99a0-4adc-a4f4-940ce1b89c50"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#2baef862-9591-4070-938e-c0194a73ae99"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#2baef862-9591-4070-938e-c0194a73ae99"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#27a44580-d07e-42f0-bb0f-f4381a21fa7d"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#27a44580-d07e-42f0-bb0f-f4381a21fa7d"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#6117f995-5769-48d1-980f-96cf7f48e304"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#6117f995-5769-48d1-980f-96cf7f48e304"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#029a7127-e7b0-49fd-8286-e5285322b2e2"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#029a7127-e7b0-49fd-8286-e5285322b2e2"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#0834a141-8c1a-4742-938b-f78578a0f772"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#0834a141-8c1a-4742-938b-f78578a0f772"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#11797bd2-0df6-4348-bb7f-f47034823811"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#11797bd2-0df6-4348-bb7f-f47034823811"
}
],
"analysis": {
"state": "in_triage",
"justification": "",
"response": [],
"detail": "This CVE is under investigation by Confluent."
}
},
{
"id": "CVE-2026-45799",
"source": {
"name": "ghsa",
"url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
},
"ratings": [
{
"source": {
"name": "ghsa"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"description": "# CVE-2026-45799\n\n## Maintainer summary\n\nWire's protobuf group-skipping logic did not reject negative lengths before skipping a\nlength-delimited field inside a group. A crafted protobuf payload could cause Wire to throw an\nunchecked runtime exception during decoding instead of the documented `IOException` /\n`ProtocolException` failure path.\n\nThis can crash services that decode untrusted protobuf payloads and only handle Wire's documented\nchecked decoding failures.\n\n## Affected artifacts\n\n### `com.squareup.wire:wire-runtime`\n\nAffected versions: vulnerable releases before `6.3.0`.\n\nPatched versions: `6.3.0` and later.\n\nUsers should upgrade to `com.squareup.wire:wire-runtime:6.3.0` or later.\n\n### `com.squareup.wire:wire-runtime-jvm`\n\nAffected versions: vulnerable legacy releases, including `5.3.1` and `5.3.3`.\n\nPatched versions: none.\n\n`com.squareup.wire:wire-runtime-jvm` is a discontinued legacy artifact and will not receive a\npatched release. Users should migrate to `com.squareup.wire:wire-runtime:6.3.0` or later.\n\n### Wire 7 alpha releases\n\nThe fix has been merged to `master` and will be included in the next Wire 7 alpha release. Until\nthat release is available, Wire 7 alpha users should avoid decoding untrusted protobuf payloads with\naffected alpha versions or build from a commit containing the fix.\n\n## Fix\n\nThe issue is fixed in Wire `6.3.0`.\n\nThe fix rejects negative lengths while skipping groups and throws `ProtocolException` instead of\nallowing the reader to move to an invalid position and later throw an unchecked runtime exception.\n\n## Credit\n\nReported by @TrekLaps.\n\n## Technical details\n\nThe following technical details are based on the original report, updated by the maintainers to\nreflect the assigned CVE, the supported fixed artifact, and the discontinued status of\n`com.squareup.wire:wire-runtime-jvm`.\n\n`ByteArrayProtoReader32.skipGroup()` in `wire-runtime` did not validate that a\n`LENGTH_DELIMITED` field's length is non-negative before calling `skip()`. A crafted protobuf\nvarint encodes `-128` as a signed `Int`. When `skip(-128)` runs, the internal position counter\nunderflows to an invalid negative position. The next `readByte()` accesses the source with that\nnegative position, throwing `ArrayIndexOutOfBoundsException`, a `RuntimeException` that escapes\nWire's documented `IOException` boundary and can crash the request handler.\n\n`ProtoAdapter.decode(byte[])` is declared to throw `IOException`. Callers following the documented\nAPI may catch only `IOException`, so unchecked runtime exceptions from malformed input can escape\nthe expected error boundary.\n\nThe originally confirmed vulnerable legacy versions include `5.3.1` and `5.3.3` for the\ndiscontinued `com.squareup.wire:wire-runtime-jvm` coordinate. The supported replacement coordinate\nis `com.squareup.wire:wire-runtime`, fixed in version `6.3.0`.\n\n## Root cause\n\nIn the originally reported vulnerable code path, `ByteArrayProtoReader32.skipGroup()` read the\nlength as a signed `Int` and used it without validating that it was non-negative:\n\n```kotlin\nSTATE_LENGTH_DELIMITED -> {\n val length = internalReadVarint32() // returns signed Int and can be negative\n skip(length) // no negative check\n}\n```\n\nThe internal `skip()` implementation then accepted the negative count because the computed\nposition was not greater than the limit:\n\n```kotlin\nprivate fun skip(byteCount: Int) {\n val newPos = pos + byteCount // for example, 7 + (-128) = -121\n if (newPos > limit) throw EOFException()\n pos = newPos // pos = -121\n}\n```\n\nThe next read could then index the source with the invalid negative position:\n\n```kotlin\nprivate fun readByte(): Byte {\n if (pos == limit) throw EOFException()\n return source[pos++] // source[-121] throws ArrayIndexOutOfBoundsException\n}\n```\n\nWire already rejected negative lengths in normal length-delimited field decoding. The same\nvalidation was missing from group-skipping code.\n\nThe fix adds this validation when skipping groups:\n\n```kotlin\nSTATE_LENGTH_DELIMITED -> {\n val length = internalReadVarint32()\n if (length < 0) throw ProtocolException(\"Negative length: $length...\")\n skip(length)\n}\n```\n\nThe fix was applied to both `ByteArrayProtoReader32.skipGroup()` and `ProtoReader.skipGroup()`.\n\n## Reproduction\n\nThe following reproduction was provided for vulnerable legacy `wire-runtime-jvm` releases such as\n`5.3.1` and `5.3.3`:\n\n```bash\ncurl -sL https://repo1.maven.org/maven2/com/squareup/wire/wire-runtime-jvm/5.3.3/wire-runtime-jvm-5.3.3.jar -o wire.jar\ncurl -sL https://repo1.maven.org/maven2/com/squareup/okio/okio-jvm/3.9.1/okio-jvm-3.9.1.jar -o okio.jar\ncurl -sL https://repo1.maven.org/maven2/org/jetbrains/kotlin/kotlin-stdlib/2.1.0/kotlin-stdlib-2.1.0.jar -o stdlib.jar\n```\n\n```java\n// WirePoc.java\nimport com.squareup.wire.AnyMessage;\n\npublic class WirePoc {\n public static void main(String[] args) throws Exception {\n byte[] payload = new byte[] {\n (byte) 0x9B, 0x06, // field 99, START_GROUP\n 0x0A, // field 1, LENGTH_DELIMITED\n (byte) 0x80, (byte) 0xFF, (byte) 0xFF, (byte) 0xFF, 0x0F, // varint = -128\n (byte) 0x9C, 0x06 // field 99, END_GROUP\n };\n\n AnyMessage.ADAPTER.decode(payload);\n }\n}\n```\n\n```bash\njavac -cp \"wire.jar:okio.jar:stdlib.jar\" WirePoc.java\njava -cp \".:wire.jar:okio.jar:stdlib.jar\" WirePoc\n```\n\nObserved output on vulnerable versions:\n\n```text\nException in thread \"main\" java.lang.ArrayIndexOutOfBoundsException: Index -120 out of bounds for length 10\n at com.squareup.wire.ByteArrayProtoReader32.readByte(ByteArrayProtoReader32.kt:448)\n at com.squareup.wire.ByteArrayProtoReader32.internalReadVarint32(ByteArrayProtoReader32.kt:294)\n at com.squareup.wire.ByteArrayProtoReader32.skipGroup(ByteArrayProtoReader32.kt:209)\n at com.squareup.wire.ByteArrayProtoReader32.nextTag(ByteArrayProtoReader32.kt:156)\n at com.squareup.wire.AnyMessage$Companion$ADAPTER$1.decode(AnyMessage.kt:150)\n at com.squareup.wire.AnyMessage$Companion$ADAPTER$1.decode(AnyMessage.kt:88)\n at com.squareup.wire.ProtoAdapter.decode(ProtoAdapter.kt:468)\n at WirePoc.main(WirePoc.java:10)\n```\n\nWith the fix, the same payload is rejected with `ProtocolException`.\n\n## Why this can affect any Wire-decoding service\n\n`skipGroup()` is called for any unknown field with wire type 3. An attacker can send an unknown\nfield, such as field 99, with wire type `START_GROUP`. The decoder skips it via `skipGroup()`\nregardless of which message type the service uses, so no schema knowledge is required.\n\nPayload:\n\n```text\n9b060a80ffffff0f9c06\n```\n\nPayload breakdown:\n\n```text\n0x9B 0x06 field 99, wire type 3 (START_GROUP)\n0x0A field 1, wire type 2 (LENGTH_DELIMITED) inside group\n0x80 0xFF 0xFF 0xFF 0x0F 5-byte varint = -128 as signed Int\n0x9C 0x06 field 99, END_GROUP\n```",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-45799"
},
{
"url": "https://github.com/square/wire"
},
{
"url": "https://github.com/square/wire/pull/3595"
},
{
"url": "https://github.com/square/wire/pull/3597"
},
{
"url": "https://github.com/square/wire/security/advisories/GHSA-7xpr-hc2w-34m9"
}
],
"affects": [
{
"ref": "pkg:maven/com.squareup.wire/wire-runtime-jvm@4.9.7",
"versions": [
{
"version": "4.9.7",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#pkg:maven/com.squareup.wire/wire-runtime-jvm@4.9.7"
},
{
"ref": "urn:cdx:605c4cf6-768c-4740-88af-644c86949366/1#pkg:maven/com.squareup.wire/wire-runtime-jvm@4.9.7"
},
{
"ref": "urn:cdx:5edaa6b5-97a5-4cb5-86fd-5c8da204e917/1#pkg:maven/com.squareup.wire/wire-runtime-jvm@4.9.7"
},
{
"ref": "urn:cdx:5c15d8a3-b4c2-4b3e-942e-57b2854d6d7c/1#pkg:maven/com.squareup.wire/wire-runtime-jvm@4.9.7"
},
{
"ref": "urn:cdx:c04a5fc7-a5fb-4f38-bfed-0fa15f9fd95f/1#pkg:maven/com.squareup.wire/wire-runtime-jvm@4.9.7"
},
{
"ref": "urn:cdx:d9316630-0b4e-424a-9b57-0891facfdb48/1#pkg:maven/com.squareup.wire/wire-runtime-jvm@4.9.7"
},
{
"ref": "urn:cdx:32a0fc77-dccf-43c8-8d4e-779797d168d8/1#070062a6-3925-438d-8dbe-0d1960295548"
},
{
"ref": "urn:cdx:9248c11a-a6c2-4e62-9a2e-7f374f557cd6/1#8a712f95-e5aa-4bb5-95d0-434a73e3d659"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#pkg:maven/com.squareup.wire/wire-runtime-jvm@4.9.7"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#pkg:maven/com.squareup.wire/wire-runtime-jvm@4.9.7"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#080c71df-d5f4-4b5e-afa7-0611a42b1025"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#353ca715-ece7-4a1c-9a75-1002d563e844"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#7064a604-047b-4b18-b252-950b638afb89"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#0ec0ea78-2305-40cd-90a1-e7f57104c05c"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#63e71f84-21f1-4fa5-b1d9-a20cb1f05b43"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:maven/com.squareup.wire/wire-runtime-jvm@4.9.7"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#446448ba-3b34-4e93-9fe7-9b6919090e89"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#1cbfd174-38a0-4ee8-806d-39217220e8d6"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#1b4e4343-5ea1-4e23-8e5e-c2d11d6f6ade"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#23c01d4d-fa9c-4a91-9cec-1cf3aa3e5f94"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#136113b4-3110-43bb-8aa4-c45dd2921233"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#5eba6fcd-5ec9-489f-9e28-8d4b8bba35ca"
}
],
"analysis": {
"state": "in_triage",
"justification": "",
"response": [],
"detail": "This CVE is under investigation by Confluent."
}
},
{
"id": "CVE-2026-47244",
"source": {
"name": "ghsa",
"url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
},
"ratings": [
{
"source": {
"name": "ghsa"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "redhat"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
}
],
"cwes": [
400
],
"description": "Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, DefaultHttp2Connection.DefaultEndpoint initialises maxActiveStreams/maxStreams to Integer.MAX_VALUE, and Http2Settings never inserts SETTINGS_MAX_CONCURRENT_STREAMS by default (Http2Settings.java:305-307 only clamps a user-supplied value). Unless the application explicitly calls initialSettings().maxConcurrentStreams(n), a Netty HTTP/2 server advertises no limit and enforces none locally. Each open stream allocates a DefaultStream object, PropertyMap slots, flow-controller state and IntObjectHashMap entry; with ~2^30 permissible odd stream IDs a single TCP connection can create hundreds of thousands of long-lived stream objects. This is also the precondition for CVE-2023-44487-style Rapid-Reset amplification, where the absence of a low concurrent cap multiplies backend work. Versions 4.1.135.Final and 4.2.15.Final patch the issue.",
"recommendation": "Upgrade io.netty:netty-codec-http2 to version 4.2.15.Final, 4.1.135.Final",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-47244"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-47244"
},
{
"url": "https://github.com/netty/netty"
},
{
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"url": "https://github.com/netty/netty/security/advisories/GHSA-5x3r-wrvg-rp6q"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47244"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47244"
}
],
"published": "2026-06-12T15:16:29+00:00",
"updated": "2026-06-15T02:11:37+00:00",
"affects": [
{
"ref": "pkg:maven/io.netty/netty-codec-http2@4.1.133.Final",
"versions": [
{
"version": "4.1.133.Final",
"status": "affected"
}
]
},
{
"ref": "pkg:maven/io.netty/netty-codec-http2@4.1.133.Final",
"versions": [
{
"version": "4.1.133.Final",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#15595dd2-d08f-4b86-bf61-f0d2334b4f6a"
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#15595dd2-d08f-4b86-bf61-f0d2334b4f6a"
},
{
"ref": "urn:cdx:605c4cf6-768c-4740-88af-644c86949366/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:605c4cf6-768c-4740-88af-644c86949366/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:5edaa6b5-97a5-4cb5-86fd-5c8da204e917/1#0e0894ab-7b48-4c85-bdb2-f828ff324d91"
},
{
"ref": "urn:cdx:5edaa6b5-97a5-4cb5-86fd-5c8da204e917/1#0e0894ab-7b48-4c85-bdb2-f828ff324d91"
},
{
"ref": "urn:cdx:5c15d8a3-b4c2-4b3e-942e-57b2854d6d7c/1#8cd5125d-fa9e-40e3-bc5f-1910b5c45e77"
},
{
"ref": "urn:cdx:5c15d8a3-b4c2-4b3e-942e-57b2854d6d7c/1#8cd5125d-fa9e-40e3-bc5f-1910b5c45e77"
},
{
"ref": "urn:cdx:1984c021-252b-4038-b5c2-7dc58cdccb34/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:1984c021-252b-4038-b5c2-7dc58cdccb34/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:d9316630-0b4e-424a-9b57-0891facfdb48/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:d9316630-0b4e-424a-9b57-0891facfdb48/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:0bc95285-afe2-4a8c-b014-7ea60e19327f/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:0bc95285-afe2-4a8c-b014-7ea60e19327f/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:32a0fc77-dccf-43c8-8d4e-779797d168d8/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:32a0fc77-dccf-43c8-8d4e-779797d168d8/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:9248c11a-a6c2-4e62-9a2e-7f374f557cd6/1#14c29612-0540-4047-b097-80520294fffc"
},
{
"ref": "urn:cdx:9248c11a-a6c2-4e62-9a2e-7f374f557cd6/1#14c29612-0540-4047-b097-80520294fffc"
},
{
"ref": "urn:cdx:41ca6524-f05d-4db2-91ba-d967a3eecf30/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:41ca6524-f05d-4db2-91ba-d967a3eecf30/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#5c904e5a-415e-450c-8ddf-3ec131cd589a"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#5c904e5a-415e-450c-8ddf-3ec131cd589a"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#52cd21f3-5953-437a-a4db-d140008d8902"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#52cd21f3-5953-437a-a4db-d140008d8902"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#1776a18b-ea19-493e-8448-534e37ab7d8f"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#1776a18b-ea19-493e-8448-534e37ab7d8f"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#69f56401-e0fc-4ef4-99e0-b18c658d9031"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#69f56401-e0fc-4ef4-99e0-b18c658d9031"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#1c6b1358-f010-497c-a98c-d6d5bc8792c2"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#1c6b1358-f010-497c-a98c-d6d5bc8792c2"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#3f5ff3a2-75c6-4c09-8c5b-511f3ba9e585"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#3f5ff3a2-75c6-4c09-8c5b-511f3ba9e585"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#0516a687-afe5-406f-a8e5-770219d501d7"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#0516a687-afe5-406f-a8e5-770219d501d7"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#89d14707-85fd-42b0-908d-baaca95ac2dc"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#89d14707-85fd-42b0-908d-baaca95ac2dc"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#377fb494-a49d-4195-9bcf-c5523a356391"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#377fb494-a49d-4195-9bcf-c5523a356391"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#1685dc87-848a-45b7-943b-1ab110607431"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#1685dc87-848a-45b7-943b-1ab110607431"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#3850e28d-2fe3-4fe9-bb10-41f7a6066903"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#3850e28d-2fe3-4fe9-bb10-41f7a6066903"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#777bc6f0-dee4-4de5-9f8c-3dedd8c1e4b9"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#777bc6f0-dee4-4de5-9f8c-3dedd8c1e4b9"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-47691",
"source": {
"name": "ghsa",
"url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
},
"ratings": [
{
"source": {
"name": "ghsa"
},
"score": 8.7,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N"
},
{
"source": {
"name": "nvd"
},
"score": 10,
"severity": "critical",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N"
},
{
"source": {
"name": "redhat"
},
"score": 8.7,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N"
}
],
"cwes": [
345
],
"description": "Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's `DnsResolveContext` insufficiently validates the bailiwick of NS records, enabling DNS Cache Poisoning. An attacker controlling an authoritative name server for a subdomain can poison the cache for parent domains (like `.co.uk`). In `io.netty.resolver.dns.DnsResolveContext.AuthoritativeNameServerList#add` method accepts any NS record from the AUTHORITY section as long as the record's name is a suffix of the questionName. Subsequently, the `handleWithAdditional` method caches the associated A records from the ADDITIONAL section directly into the `authoritativeDnsServerCache` under the parent domain's key. This bypasses standard bailiwick rules, where a server authoritative for a subdomain should not be trusted to provide authoritative records for its parent. The poisoned cache is then used for all future resolutions under the parent domain's key. Versions 4.1.135.Final and 4.2.15.Final patch the issue.",
"recommendation": "Upgrade io.netty:netty-resolver-dns to version 4.2.15.Final, 4.1.135.Final",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-47691"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-47691"
},
{
"url": "https://github.com/netty/netty"
},
{
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"url": "https://github.com/netty/netty/security/advisories/GHSA-5pvg-856g-cp85"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47691"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47691"
}
],
"published": "2026-06-12T16:16:30+00:00",
"updated": "2026-06-15T01:57:41+00:00",
"affects": [
{
"ref": "pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final",
"versions": [
{
"version": "4.1.133.Final",
"status": "affected"
}
]
},
{
"ref": "pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final",
"versions": [
{
"version": "4.1.133.Final",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#11b2c4dd-dbd5-4309-9f11-6546378f1dbd"
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#11b2c4dd-dbd5-4309-9f11-6546378f1dbd"
},
{
"ref": "urn:cdx:605c4cf6-768c-4740-88af-644c86949366/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:605c4cf6-768c-4740-88af-644c86949366/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:5edaa6b5-97a5-4cb5-86fd-5c8da204e917/1#35c0cd5b-8c74-4699-92eb-f58f4e275044"
},
{
"ref": "urn:cdx:5edaa6b5-97a5-4cb5-86fd-5c8da204e917/1#35c0cd5b-8c74-4699-92eb-f58f4e275044"
},
{
"ref": "urn:cdx:5c15d8a3-b4c2-4b3e-942e-57b2854d6d7c/1#45ac735a-3ca6-4c14-85a7-62d2bb2523c0"
},
{
"ref": "urn:cdx:5c15d8a3-b4c2-4b3e-942e-57b2854d6d7c/1#45ac735a-3ca6-4c14-85a7-62d2bb2523c0"
},
{
"ref": "urn:cdx:1984c021-252b-4038-b5c2-7dc58cdccb34/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:1984c021-252b-4038-b5c2-7dc58cdccb34/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:d9316630-0b4e-424a-9b57-0891facfdb48/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:d9316630-0b4e-424a-9b57-0891facfdb48/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:0bc95285-afe2-4a8c-b014-7ea60e19327f/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:0bc95285-afe2-4a8c-b014-7ea60e19327f/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:32a0fc77-dccf-43c8-8d4e-779797d168d8/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:32a0fc77-dccf-43c8-8d4e-779797d168d8/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:9248c11a-a6c2-4e62-9a2e-7f374f557cd6/1#dd5bbd80-bc04-4051-8f3f-aa9392aff627"
},
{
"ref": "urn:cdx:9248c11a-a6c2-4e62-9a2e-7f374f557cd6/1#dd5bbd80-bc04-4051-8f3f-aa9392aff627"
},
{
"ref": "urn:cdx:41ca6524-f05d-4db2-91ba-d967a3eecf30/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:41ca6524-f05d-4db2-91ba-d967a3eecf30/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#532eeb32-679a-4d60-96a7-f8fa6f7ae2a3"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#532eeb32-679a-4d60-96a7-f8fa6f7ae2a3"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#14abf70f-ee21-4375-bbad-5ac81bb2f25d"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#14abf70f-ee21-4375-bbad-5ac81bb2f25d"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#14c3ac2c-b69c-4149-80ec-530ccf2e8d62"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#14c3ac2c-b69c-4149-80ec-530ccf2e8d62"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#22b2b37a-6a03-4de7-b27c-0f94d17f3bfa"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#22b2b37a-6a03-4de7-b27c-0f94d17f3bfa"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#665eeaa0-cc96-417e-9837-62efb76e7c59"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#665eeaa0-cc96-417e-9837-62efb76e7c59"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#08c5dec2-99a0-4adc-a4f4-940ce1b89c50"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#08c5dec2-99a0-4adc-a4f4-940ce1b89c50"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:maven/io.netty/netty-resolver-dns@4.1.133.Final"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#2baef862-9591-4070-938e-c0194a73ae99"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#2baef862-9591-4070-938e-c0194a73ae99"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#27a44580-d07e-42f0-bb0f-f4381a21fa7d"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#27a44580-d07e-42f0-bb0f-f4381a21fa7d"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#6117f995-5769-48d1-980f-96cf7f48e304"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#6117f995-5769-48d1-980f-96cf7f48e304"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#029a7127-e7b0-49fd-8286-e5285322b2e2"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#029a7127-e7b0-49fd-8286-e5285322b2e2"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#0834a141-8c1a-4742-938b-f78578a0f772"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#0834a141-8c1a-4742-938b-f78578a0f772"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#11797bd2-0df6-4348-bb7f-f47034823811"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#11797bd2-0df6-4348-bb7f-f47034823811"
}
],
"analysis": {
"state": "in_triage",
"justification": "",
"response": [],
"detail": "This CVE is under investigation by Confluent."
}
},
{
"id": "CVE-2026-48043",
"source": {
"name": "ghsa",
"url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
},
"ratings": [
{
"source": {
"name": "ghsa"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"cwes": [
400,
401
],
"description": "Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a per-stream `EmbeddedChannel` that runs the appropriate decompression codec (gzip, deflate, zstd) and forwards decompressed chunks to a wrapped listener. Each decompressed chunk is a pooled `ByteBuf` handed to an anonymous `ChannelInboundHandlerAdapter` tail handler, which becomes the sole owner responsible for releasing it. A remote peer could send frames that would result in the flow-controller throwing and so trigger a resource leak which at the end might take down the whole JVM due OOME. Versions 4.1.135.Final and 4.2.15.Final patch the issue.",
"recommendation": "Upgrade io.netty:netty-codec-http2 to version 4.1.135.Final, 4.2.15.Final",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-48043"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-48043"
},
{
"url": "https://github.com/netty/netty"
},
{
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"url": "https://github.com/netty/netty/security/advisories/GHSA-c2gf-v879-257j"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48043"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-48043"
}
],
"published": "2026-06-12T16:16:30+00:00",
"updated": "2026-06-15T01:56:42+00:00",
"affects": [
{
"ref": "pkg:maven/io.netty/netty-codec-http2@4.1.133.Final",
"versions": [
{
"version": "4.1.133.Final",
"status": "affected"
}
]
},
{
"ref": "pkg:maven/io.netty/netty-codec-http2@4.1.133.Final",
"versions": [
{
"version": "4.1.133.Final",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#15595dd2-d08f-4b86-bf61-f0d2334b4f6a"
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#15595dd2-d08f-4b86-bf61-f0d2334b4f6a"
},
{
"ref": "urn:cdx:605c4cf6-768c-4740-88af-644c86949366/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:605c4cf6-768c-4740-88af-644c86949366/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:5edaa6b5-97a5-4cb5-86fd-5c8da204e917/1#0e0894ab-7b48-4c85-bdb2-f828ff324d91"
},
{
"ref": "urn:cdx:5edaa6b5-97a5-4cb5-86fd-5c8da204e917/1#0e0894ab-7b48-4c85-bdb2-f828ff324d91"
},
{
"ref": "urn:cdx:5c15d8a3-b4c2-4b3e-942e-57b2854d6d7c/1#8cd5125d-fa9e-40e3-bc5f-1910b5c45e77"
},
{
"ref": "urn:cdx:5c15d8a3-b4c2-4b3e-942e-57b2854d6d7c/1#8cd5125d-fa9e-40e3-bc5f-1910b5c45e77"
},
{
"ref": "urn:cdx:1984c021-252b-4038-b5c2-7dc58cdccb34/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:1984c021-252b-4038-b5c2-7dc58cdccb34/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:d9316630-0b4e-424a-9b57-0891facfdb48/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:d9316630-0b4e-424a-9b57-0891facfdb48/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:0bc95285-afe2-4a8c-b014-7ea60e19327f/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:0bc95285-afe2-4a8c-b014-7ea60e19327f/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:32a0fc77-dccf-43c8-8d4e-779797d168d8/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:32a0fc77-dccf-43c8-8d4e-779797d168d8/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:9248c11a-a6c2-4e62-9a2e-7f374f557cd6/1#14c29612-0540-4047-b097-80520294fffc"
},
{
"ref": "urn:cdx:9248c11a-a6c2-4e62-9a2e-7f374f557cd6/1#14c29612-0540-4047-b097-80520294fffc"
},
{
"ref": "urn:cdx:41ca6524-f05d-4db2-91ba-d967a3eecf30/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:41ca6524-f05d-4db2-91ba-d967a3eecf30/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#5c904e5a-415e-450c-8ddf-3ec131cd589a"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#5c904e5a-415e-450c-8ddf-3ec131cd589a"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#52cd21f3-5953-437a-a4db-d140008d8902"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#52cd21f3-5953-437a-a4db-d140008d8902"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#1776a18b-ea19-493e-8448-534e37ab7d8f"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#1776a18b-ea19-493e-8448-534e37ab7d8f"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#69f56401-e0fc-4ef4-99e0-b18c658d9031"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#69f56401-e0fc-4ef4-99e0-b18c658d9031"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#1c6b1358-f010-497c-a98c-d6d5bc8792c2"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#1c6b1358-f010-497c-a98c-d6d5bc8792c2"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#3f5ff3a2-75c6-4c09-8c5b-511f3ba9e585"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#3f5ff3a2-75c6-4c09-8c5b-511f3ba9e585"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#0516a687-afe5-406f-a8e5-770219d501d7"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#0516a687-afe5-406f-a8e5-770219d501d7"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#89d14707-85fd-42b0-908d-baaca95ac2dc"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#89d14707-85fd-42b0-908d-baaca95ac2dc"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#377fb494-a49d-4195-9bcf-c5523a356391"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#377fb494-a49d-4195-9bcf-c5523a356391"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#1685dc87-848a-45b7-943b-1ab110607431"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#1685dc87-848a-45b7-943b-1ab110607431"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#3850e28d-2fe3-4fe9-bb10-41f7a6066903"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#3850e28d-2fe3-4fe9-bb10-41f7a6066903"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#777bc6f0-dee4-4de5-9f8c-3dedd8c1e4b9"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#777bc6f0-dee4-4de5-9f8c-3dedd8c1e4b9"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-50010",
"source": {
"name": "ghsa",
"url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
},
"ratings": [
{
"source": {
"name": "ghsa"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "redhat"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"cwes": [
347
],
"description": "Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrapper, which extends X509ExtendedTrustManager but implements the 3-arg checkServerTrusted(chain, authType, SSLEngine) by discarding the SSLEngine and calling the 2-arg delegate. Because the object now IS an X509ExtendedTrustManager, neither SunJSSE's internal AbstractTrustManagerWrapper nor Netty's own OpenSslX509TrustManagerWrapper will re-wrap it to add endpoint-identification. Consequently, even though Netty 4.2 sets endpointIdentificationAlgorithm=\"HTTPS\" by default, a client built with `SslContextBuilder.forClient().trustManager(somePlainX509TrustManager)` performs no hostname verification at all. Versions 4.1.135.Final and 4.2.15.Final patch the issue.",
"recommendation": "Upgrade io.netty:netty-handler to version 4.2.15.Final, 4.1.135.Final",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-50010"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-50010"
},
{
"url": "https://github.com/netty/netty"
},
{
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"url": "https://github.com/netty/netty/security/advisories/GHSA-c653-97m9-rcg9"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50010"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50010"
}
],
"published": "2026-06-12T16:16:31+00:00",
"updated": "2026-06-15T02:31:50+00:00",
"affects": [
{
"ref": "pkg:maven/io.netty/netty-handler@4.1.133.Final",
"versions": [
{
"version": "4.1.133.Final",
"status": "affected"
}
]
},
{
"ref": "pkg:maven/io.netty/netty-handler@4.1.133.Final",
"versions": [
{
"version": "4.1.133.Final",
"status": "affected"
}
]
},
{
"ref": "pkg:maven/io.netty/netty-handler@4.1.133.Final",
"versions": [
{
"version": "4.1.133.Final",
"status": "affected"
}
]
},
{
"ref": "pkg:maven/io.netty/netty-handler@4.1.133.Final",
"versions": [
{
"version": "4.1.133.Final",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#37c2beb5-ed54-4208-88be-327232338d84"
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#37c2beb5-ed54-4208-88be-327232338d84"
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#37c2beb5-ed54-4208-88be-327232338d84"
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#37c2beb5-ed54-4208-88be-327232338d84"
},
{
"ref": "urn:cdx:605c4cf6-768c-4740-88af-644c86949366/1#a92097ac-b709-4542-a2d8-e01b63edbd42"
},
{
"ref": "urn:cdx:605c4cf6-768c-4740-88af-644c86949366/1#a92097ac-b709-4542-a2d8-e01b63edbd42"
},
{
"ref": "urn:cdx:605c4cf6-768c-4740-88af-644c86949366/1#a92097ac-b709-4542-a2d8-e01b63edbd42"
},
{
"ref": "urn:cdx:605c4cf6-768c-4740-88af-644c86949366/1#a92097ac-b709-4542-a2d8-e01b63edbd42"
},
{
"ref": "urn:cdx:5edaa6b5-97a5-4cb5-86fd-5c8da204e917/1#047bcb7c-edfb-4b9f-81a1-064e6d23fbf6"
},
{
"ref": "urn:cdx:5edaa6b5-97a5-4cb5-86fd-5c8da204e917/1#047bcb7c-edfb-4b9f-81a1-064e6d23fbf6"
},
{
"ref": "urn:cdx:5edaa6b5-97a5-4cb5-86fd-5c8da204e917/1#047bcb7c-edfb-4b9f-81a1-064e6d23fbf6"
},
{
"ref": "urn:cdx:5edaa6b5-97a5-4cb5-86fd-5c8da204e917/1#047bcb7c-edfb-4b9f-81a1-064e6d23fbf6"
},
{
"ref": "urn:cdx:00efd76e-fc8f-48fa-a71d-c9d70b5f9447/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:00efd76e-fc8f-48fa-a71d-c9d70b5f9447/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:00efd76e-fc8f-48fa-a71d-c9d70b5f9447/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:00efd76e-fc8f-48fa-a71d-c9d70b5f9447/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:5c15d8a3-b4c2-4b3e-942e-57b2854d6d7c/1#16b3b91c-aa4e-4f76-9f50-f82831e7792f"
},
{
"ref": "urn:cdx:5c15d8a3-b4c2-4b3e-942e-57b2854d6d7c/1#16b3b91c-aa4e-4f76-9f50-f82831e7792f"
},
{
"ref": "urn:cdx:5c15d8a3-b4c2-4b3e-942e-57b2854d6d7c/1#16b3b91c-aa4e-4f76-9f50-f82831e7792f"
},
{
"ref": "urn:cdx:5c15d8a3-b4c2-4b3e-942e-57b2854d6d7c/1#16b3b91c-aa4e-4f76-9f50-f82831e7792f"
},
{
"ref": "urn:cdx:1984c021-252b-4038-b5c2-7dc58cdccb34/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:1984c021-252b-4038-b5c2-7dc58cdccb34/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:1984c021-252b-4038-b5c2-7dc58cdccb34/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:1984c021-252b-4038-b5c2-7dc58cdccb34/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:c04a5fc7-a5fb-4f38-bfed-0fa15f9fd95f/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:c04a5fc7-a5fb-4f38-bfed-0fa15f9fd95f/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:c04a5fc7-a5fb-4f38-bfed-0fa15f9fd95f/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:c04a5fc7-a5fb-4f38-bfed-0fa15f9fd95f/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:d9316630-0b4e-424a-9b57-0891facfdb48/1#25cce3bb-48df-4d8d-81e6-79e40e6f46f8"
},
{
"ref": "urn:cdx:d9316630-0b4e-424a-9b57-0891facfdb48/1#25cce3bb-48df-4d8d-81e6-79e40e6f46f8"
},
{
"ref": "urn:cdx:d9316630-0b4e-424a-9b57-0891facfdb48/1#25cce3bb-48df-4d8d-81e6-79e40e6f46f8"
},
{
"ref": "urn:cdx:d9316630-0b4e-424a-9b57-0891facfdb48/1#25cce3bb-48df-4d8d-81e6-79e40e6f46f8"
},
{
"ref": "urn:cdx:b5e3ea0e-3953-4d71-9f97-b04d97cc22f4/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:b5e3ea0e-3953-4d71-9f97-b04d97cc22f4/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:b5e3ea0e-3953-4d71-9f97-b04d97cc22f4/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:b5e3ea0e-3953-4d71-9f97-b04d97cc22f4/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:0bc95285-afe2-4a8c-b014-7ea60e19327f/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:0bc95285-afe2-4a8c-b014-7ea60e19327f/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:0bc95285-afe2-4a8c-b014-7ea60e19327f/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:0bc95285-afe2-4a8c-b014-7ea60e19327f/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:32a0fc77-dccf-43c8-8d4e-779797d168d8/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:32a0fc77-dccf-43c8-8d4e-779797d168d8/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:32a0fc77-dccf-43c8-8d4e-779797d168d8/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:32a0fc77-dccf-43c8-8d4e-779797d168d8/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:9248c11a-a6c2-4e62-9a2e-7f374f557cd6/1#135f630d-516f-4cf4-94fd-24f64dfd0991"
},
{
"ref": "urn:cdx:9248c11a-a6c2-4e62-9a2e-7f374f557cd6/1#135f630d-516f-4cf4-94fd-24f64dfd0991"
},
{
"ref": "urn:cdx:9248c11a-a6c2-4e62-9a2e-7f374f557cd6/1#135f630d-516f-4cf4-94fd-24f64dfd0991"
},
{
"ref": "urn:cdx:9248c11a-a6c2-4e62-9a2e-7f374f557cd6/1#135f630d-516f-4cf4-94fd-24f64dfd0991"
},
{
"ref": "urn:cdx:41ca6524-f05d-4db2-91ba-d967a3eecf30/1#88ef17f0-c17a-4dd6-89d5-092f64483a75"
},
{
"ref": "urn:cdx:41ca6524-f05d-4db2-91ba-d967a3eecf30/1#88ef17f0-c17a-4dd6-89d5-092f64483a75"
},
{
"ref": "urn:cdx:41ca6524-f05d-4db2-91ba-d967a3eecf30/1#88ef17f0-c17a-4dd6-89d5-092f64483a75"
},
{
"ref": "urn:cdx:41ca6524-f05d-4db2-91ba-d967a3eecf30/1#88ef17f0-c17a-4dd6-89d5-092f64483a75"
},
{
"ref": "urn:cdx:d3b561a2-679f-4ee3-9e2d-46972f27bfa5/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:d3b561a2-679f-4ee3-9e2d-46972f27bfa5/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:d3b561a2-679f-4ee3-9e2d-46972f27bfa5/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:d3b561a2-679f-4ee3-9e2d-46972f27bfa5/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#98cf1bd1-9cc9-4b31-8c8e-006109dea75f"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#98cf1bd1-9cc9-4b31-8c8e-006109dea75f"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#98cf1bd1-9cc9-4b31-8c8e-006109dea75f"
},
{
"ref": "urn:cdx:877d15b2-2d99-4893-bebc-3e6f30fd65fc/1#98cf1bd1-9cc9-4b31-8c8e-006109dea75f"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#66438181-1402-45e2-bb43-543c9ecd2f2d"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#66438181-1402-45e2-bb43-543c9ecd2f2d"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#66438181-1402-45e2-bb43-543c9ecd2f2d"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#66438181-1402-45e2-bb43-543c9ecd2f2d"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#772673bc-cc3e-4e4d-b468-6c7b46bc33a8"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#772673bc-cc3e-4e4d-b468-6c7b46bc33a8"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#772673bc-cc3e-4e4d-b468-6c7b46bc33a8"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#772673bc-cc3e-4e4d-b468-6c7b46bc33a8"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#2805e2d9-5f42-437d-9946-ca02368992b3"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#2805e2d9-5f42-437d-9946-ca02368992b3"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#2805e2d9-5f42-437d-9946-ca02368992b3"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#2805e2d9-5f42-437d-9946-ca02368992b3"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#031b59ef-faee-4211-ba14-ff42b04b5400"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#031b59ef-faee-4211-ba14-ff42b04b5400"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#031b59ef-faee-4211-ba14-ff42b04b5400"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#031b59ef-faee-4211-ba14-ff42b04b5400"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:dc71786c-5c9a-4a47-95c4-61a1a8dfa552/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#0077b380-579f-47e4-850d-ce2a5dfd967c"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#0077b380-579f-47e4-850d-ce2a5dfd967c"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#0077b380-579f-47e4-850d-ce2a5dfd967c"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#0077b380-579f-47e4-850d-ce2a5dfd967c"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#4082167c-50df-4572-8fb7-5f292763265e"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#4082167c-50df-4572-8fb7-5f292763265e"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#4082167c-50df-4572-8fb7-5f292763265e"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#4082167c-50df-4572-8fb7-5f292763265e"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#1fed2ce7-23fc-4448-a23e-ae69ad84151c"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#1fed2ce7-23fc-4448-a23e-ae69ad84151c"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#1fed2ce7-23fc-4448-a23e-ae69ad84151c"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#1fed2ce7-23fc-4448-a23e-ae69ad84151c"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#37cd69d0-8a17-442b-ae26-b63270307d15"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#37cd69d0-8a17-442b-ae26-b63270307d15"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#37cd69d0-8a17-442b-ae26-b63270307d15"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#37cd69d0-8a17-442b-ae26-b63270307d15"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#a9d5648d-6275-4268-83a3-698ce5fdf16d"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#a9d5648d-6275-4268-83a3-698ce5fdf16d"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#a9d5648d-6275-4268-83a3-698ce5fdf16d"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#a9d5648d-6275-4268-83a3-698ce5fdf16d"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#07a67c48-cde2-43b3-94da-ca47a526c7f5"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#07a67c48-cde2-43b3-94da-ca47a526c7f5"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#07a67c48-cde2-43b3-94da-ca47a526c7f5"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#07a67c48-cde2-43b3-94da-ca47a526c7f5"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#05c74c07-d4e8-47a5-916f-dfeb102fee06"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#05c74c07-d4e8-47a5-916f-dfeb102fee06"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#05c74c07-d4e8-47a5-916f-dfeb102fee06"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#05c74c07-d4e8-47a5-916f-dfeb102fee06"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#10816bbd-0797-4d62-86cf-856806060923"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#10816bbd-0797-4d62-86cf-856806060923"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#10816bbd-0797-4d62-86cf-856806060923"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#10816bbd-0797-4d62-86cf-856806060923"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#04db8419-4978-4458-a34e-e2f50653a407"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#04db8419-4978-4458-a34e-e2f50653a407"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#04db8419-4978-4458-a34e-e2f50653a407"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#04db8419-4978-4458-a34e-e2f50653a407"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#02171dc6-0a0b-44c2-a189-4115dcae56d9"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#02171dc6-0a0b-44c2-a189-4115dcae56d9"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#02171dc6-0a0b-44c2-a189-4115dcae56d9"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#02171dc6-0a0b-44c2-a189-4115dcae56d9"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:1fc5c856-c050-414d-94c0-819e5afdba90/1#pkg:maven/io.netty/netty-handler@4.1.133.Final"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#4916c288-7136-410d-9fca-33e8908bfb9f"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#4916c288-7136-410d-9fca-33e8908bfb9f"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#4916c288-7136-410d-9fca-33e8908bfb9f"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#4916c288-7136-410d-9fca-33e8908bfb9f"
}
],
"analysis": {
"state": "not_affected",
"justification": "protected_by_mitigating_control",
"response": [
"update"
],
"detail": "Code present in ce-kafka, ksql, and schroedinger telemetry-client\nCode unreachable in ksql, telemetry-client. In ce-kafka, there is a mitigation in place for ce-kafka client. \nMetrics client is affected via shaded netty, this only CP in very limited configurations. "
}
},
{
"id": "CVE-2026-50020",
"source": {
"name": "ghsa",
"url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
},
"ratings": [
{
"source": {
"name": "ghsa"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
{
"source": {
"name": "redhat"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
}
],
"cwes": [
444
],
"description": "Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, before reading the first request-line, `HttpObjectDecoder` skips every byte for which `Character.isISOControl(b)` is `true` (0x00\u20130x1F and 0x7F) as well as all whitespace. RFC 9112 \u00a72.2 only asks servers to ignore empty CRLF lines preceding the request-line \u2014 a carefully scoped robustness allowance intended to handle HTTP/1.0 POST workarounds. Silently absorbing NUL bytes, SOH, STX, and other non-CRLF control characters goes significantly beyond this, and can be exploited for request-boundary confusion in pipelined or multiplexed transports where a front-end component treats those bytes differently. Versions 4.1.135.Final and 4.2.15.Final patch the issue.",
"recommendation": "Upgrade io.netty:netty-codec-http to version 4.2.15.Final, 4.1.135.Final",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-50020"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-50020"
},
{
"url": "https://github.com/netty/netty"
},
{
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"url": "https://github.com/netty/netty/security/advisories/GHSA-hvcg-qmg6-jm4c"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50020"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50020"
}
],
"published": "2026-06-12T16:16:31+00:00",
"updated": "2026-06-15T02:31:10+00:00",
"affects": [
{
"ref": "pkg:maven/io.netty/netty-codec-http@4.1.133.Final",
"versions": [
{
"version": "4.1.133.Final",
"status": "affected"
}
]
},
{
"ref": "pkg:maven/io.netty/netty-codec-http@4.1.133.Final",
"versions": [
{
"version": "4.1.133.Final",
"status": "affected"
}
]
},
{
"ref": "pkg:maven/io.netty/netty-codec-http@4.1.133.Final",
"versions": [
{
"version": "4.1.133.Final",
"status": "affected"
}
]
},
{
"ref": "pkg:maven/io.netty/netty-codec-http@4.1.133.Final",
"versions": [
{
"version": "4.1.133.Final",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#656fb108-86b7-4133-bd54-bc39763a2e9a"
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#656fb108-86b7-4133-bd54-bc39763a2e9a"
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#656fb108-86b7-4133-bd54-bc39763a2e9a"
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#656fb108-86b7-4133-bd54-bc39763a2e9a"
},
{
"ref": "urn:cdx:605c4cf6-768c-4740-88af-644c86949366/1#9a8a9313-4702-4c0d-b7ce-05f83361635a"
},
{
"ref": "urn:cdx:605c4cf6-768c-4740-88af-644c86949366/1#9a8a9313-4702-4c0d-b7ce-05f83361635a"
},
{
"ref": "urn:cdx:605c4cf6-768c-4740-88af-644c86949366/1#9a8a9313-4702-4c0d-b7ce-05f83361635a"
},
{
"ref": "urn:cdx:605c4cf6-768c-4740-88af-644c86949366/1#9a8a9313-4702-4c0d-b7ce-05f83361635a"
},
{
"ref": "urn:cdx:5edaa6b5-97a5-4cb5-86fd-5c8da204e917/1#b132aab4-88ce-468c-8462-7ae0c1dd1f88"
},
{
"ref": "urn:cdx:5edaa6b5-97a5-4cb5-86fd-5c8da204e917/1#b132aab4-88ce-468c-8462-7ae0c1dd1f88"
},
{
"ref": "urn:cdx:5edaa6b5-97a5-4cb5-86fd-5c8da204e917/1#b132aab4-88ce-468c-8462-7ae0c1dd1f88"
},
{
"ref": "urn:cdx:5edaa6b5-97a5-4cb5-86fd-5c8da204e917/1#b132aab4-88ce-468c-8462-7ae0c1dd1f88"
},
{
"ref": "urn:cdx:5c15d8a3-b4c2-4b3e-942e-57b2854d6d7c/1#6285ae17-69bc-4c5a-9017-7a9c541ff705"
},
{
"ref": "urn:cdx:5c15d8a3-b4c2-4b3e-942e-57b2854d6d7c/1#6285ae17-69bc-4c5a-9017-7a9c541ff705"
},
{
"ref": "urn:cdx:5c15d8a3-b4c2-4b3e-942e-57b2854d6d7c/1#6285ae17-69bc-4c5a-9017-7a9c541ff705"
},
{
"ref": "urn:cdx:5c15d8a3-b4c2-4b3e-942e-57b2854d6d7c/1#6285ae17-69bc-4c5a-9017-7a9c541ff705"
},
{
"ref": "urn:cdx:1984c021-252b-4038-b5c2-7dc58cdccb34/1#pkg:maven/io.netty/netty-codec-http@4.1.133.Final"
},
{
"ref": "urn:cdx:1984c021-252b-4038-b5c2-7dc58cdccb34/1#pkg:maven/io.netty/netty-codec-http@4.1.133.Final"
},
{
"ref": "urn:cdx:1984c021-252b-4038-b5c2-7dc58cdccb34/1#pkg:maven/io.netty/netty-codec-http@4.1.133.Final"
},
{
"ref": "urn:cdx:1984c021-252b-4038-b5c2-7dc58cdccb34/1#pkg:maven/io.netty/netty-codec-http@4.1.133.Final"
},
{
"ref": "urn:cdx:d9316630-0b4e-424a-9b57-0891facfdb48/1#00a4a3f9-b77c-4b04-8917-69f5632c4e76"
},
{
"ref": "urn:cdx:d9316630-0b4e-424a-9b57-0891facfdb48/1#00a4a3f9-b77c-4b04-8917-69f5632c4e76"
},
{
"ref": "urn:cdx:d9316630-0b4e-424a-9b57-0891facfdb48/1#00a4a3f9-b77c-4b04-8917-69f5632c4e76"
},
{
"ref": "urn:cdx:d9316630-0b4e-424a-9b57-0891facfdb48/1#00a4a3f9-b77c-4b04-8917-69f5632c4e76"
},
{
"ref": "urn:cdx:b5e3ea0e-3953-4d71-9f97-b04d97cc22f4/1#pkg:maven/io.netty/netty-codec-http@4.1.133.Final"
},
{
"ref": "urn:cdx:b5e3ea0e-3953-4d71-9f97-b04d97cc22f4/1#pkg:maven/io.netty/netty-codec-http@4.1.133.Final"
},
{
"ref": "urn:cdx:b5e3ea0e-3953-4d71-9f97-b04d97cc22f4/1#pkg:maven/io.netty/netty-codec-http@4.1.133.Final"
},
{
"ref": "urn:cdx:b5e3ea0e-3953-4d71-9f97-b04d97cc22f4/1#pkg:maven/io.netty/netty-codec-http@4.1.133.Final"
},
{
"ref": "urn:cdx:0bc95285-afe2-4a8c-b014-7ea60e19327f/1#pkg:maven/io.netty/netty-codec-http@4.1.133.Final"
},
{
"ref": "urn:cdx:0bc95285-afe2-4a8c-b014-7ea60e19327f/1#pkg:maven/io.netty/netty-codec-http@4.1.133.Final"
},
{
"ref": "urn:cdx:0bc95285-afe2-4a8c-b014-7ea60e19327f/1#pkg:maven/io.netty/netty-codec-http@4.1.133.Final"
},
{
"ref": "urn:cdx:0bc95285-afe2-4a8c-b014-7ea60e19327f/1#pkg:maven/io.netty/netty-codec-http@4.1.133.Final"
},
{
"ref": "urn:cdx:32a0fc77-dccf-43c8-8d4e-779797d168d8/1#pkg:maven/io.netty/netty-codec-http@4.1.133.Final"
},
{
"ref": "urn:cdx:32a0fc77-dccf-43c8-8d4e-779797d168d8/1#pkg:maven/io.netty/netty-codec-http@4.1.133.Final"
},
{
"ref": "urn:cdx:32a0fc77-dccf-43c8-8d4e-779797d168d8/1#pkg:maven/io.netty/netty-codec-http@4.1.133.Final"
},
{
"ref": "urn:cdx:32a0fc77-dccf-43c8-8d4e-779797d168d8/1#pkg:maven/io.netty/netty-codec-http@4.1.133.Final"
},
{
"ref": "urn:cdx:9248c11a-a6c2-4e62-9a2e-7f374f557cd6/1#0223aa6f-8e74-4333-95c4-498fdc2d2c14"
},
{
"ref": "urn:cdx:9248c11a-a6c2-4e62-9a2e-7f374f557cd6/1#0223aa6f-8e74-4333-95c4-498fdc2d2c14"
},
{
"ref": "urn:cdx:9248c11a-a6c2-4e62-9a2e-7f374f557cd6/1#0223aa6f-8e74-4333-95c4-498fdc2d2c14"
},
{
"ref": "urn:cdx:9248c11a-a6c2-4e62-9a2e-7f374f557cd6/1#0223aa6f-8e74-4333-95c4-498fdc2d2c14"
},
{
"ref": "urn:cdx:41ca6524-f05d-4db2-91ba-d967a3eecf30/1#6028d511-cd2a-411e-9247-64712c1874d4"
},
{
"ref": "urn:cdx:41ca6524-f05d-4db2-91ba-d967a3eecf30/1#6028d511-cd2a-411e-9247-64712c1874d4"
},
{
"ref": "urn:cdx:41ca6524-f05d-4db2-91ba-d967a3eecf30/1#6028d511-cd2a-411e-9247-64712c1874d4"
},
{
"ref": "urn:cdx:41ca6524-f05d-4db2-91ba-d967a3eecf30/1#6028d511-cd2a-411e-9247-64712c1874d4"
},
{
"ref": "urn:cdx:d3b561a2-679f-4ee3-9e2d-46972f27bfa5/1#pkg:maven/io.netty/netty-codec-http@4.1.133.Final"
},
{
"ref": "urn:cdx:d3b561a2-679f-4ee3-9e2d-46972f27bfa5/1#pkg:maven/io.netty/netty-codec-http@4.1.133.Final"
},
{
"ref": "urn:cdx:d3b561a2-679f-4ee3-9e2d-46972f27bfa5/1#pkg:maven/io.netty/netty-codec-http@4.1.133.Final"
},
{
"ref": "urn:cdx:d3b561a2-679f-4ee3-9e2d-46972f27bfa5/1#pkg:maven/io.netty/netty-codec-http@4.1.133.Final"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#575e716a-d7c5-42b5-b28e-eca5c72a117b"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#575e716a-d7c5-42b5-b28e-eca5c72a117b"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#575e716a-d7c5-42b5-b28e-eca5c72a117b"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#575e716a-d7c5-42b5-b28e-eca5c72a117b"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#8dcdbb45-aa2e-4b4e-8251-0f4efd1afcfd"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#8dcdbb45-aa2e-4b4e-8251-0f4efd1afcfd"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#8dcdbb45-aa2e-4b4e-8251-0f4efd1afcfd"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#8dcdbb45-aa2e-4b4e-8251-0f4efd1afcfd"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#07b7ce85-45b3-458d-8e3c-74f5bb3ba57b"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#07b7ce85-45b3-458d-8e3c-74f5bb3ba57b"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#07b7ce85-45b3-458d-8e3c-74f5bb3ba57b"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#07b7ce85-45b3-458d-8e3c-74f5bb3ba57b"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#0adb6dcf-1048-4d50-b080-5b18392e56e8"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#0adb6dcf-1048-4d50-b080-5b18392e56e8"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#0adb6dcf-1048-4d50-b080-5b18392e56e8"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#0adb6dcf-1048-4d50-b080-5b18392e56e8"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#097ba61d-1aa1-4e15-8392-5c98c7b51a78"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#097ba61d-1aa1-4e15-8392-5c98c7b51a78"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#097ba61d-1aa1-4e15-8392-5c98c7b51a78"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#097ba61d-1aa1-4e15-8392-5c98c7b51a78"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#00cf8c17-60f0-4de4-88b0-e30f3ed90afb"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#00cf8c17-60f0-4de4-88b0-e30f3ed90afb"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#00cf8c17-60f0-4de4-88b0-e30f3ed90afb"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#00cf8c17-60f0-4de4-88b0-e30f3ed90afb"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#10d700c8-eb8e-4599-b036-0ed287e1e47b"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#10d700c8-eb8e-4599-b036-0ed287e1e47b"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#10d700c8-eb8e-4599-b036-0ed287e1e47b"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#10d700c8-eb8e-4599-b036-0ed287e1e47b"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#758a24cd-ba4a-4447-b0fc-c673f4636e0f"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#758a24cd-ba4a-4447-b0fc-c673f4636e0f"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#758a24cd-ba4a-4447-b0fc-c673f4636e0f"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#758a24cd-ba4a-4447-b0fc-c673f4636e0f"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#4296e86f-1540-45fa-96f9-a50d5fa4967a"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#4296e86f-1540-45fa-96f9-a50d5fa4967a"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#4296e86f-1540-45fa-96f9-a50d5fa4967a"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#4296e86f-1540-45fa-96f9-a50d5fa4967a"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#145b7b5f-b62c-4071-b15c-5199d6a06d21"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#145b7b5f-b62c-4071-b15c-5199d6a06d21"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#145b7b5f-b62c-4071-b15c-5199d6a06d21"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#145b7b5f-b62c-4071-b15c-5199d6a06d21"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#0188adae-a521-4ba1-803e-76cebbf08107"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#0188adae-a521-4ba1-803e-76cebbf08107"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#0188adae-a521-4ba1-803e-76cebbf08107"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#0188adae-a521-4ba1-803e-76cebbf08107"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#00bd76a6-0535-4ede-b7e5-484812fd3711"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#00bd76a6-0535-4ede-b7e5-484812fd3711"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#00bd76a6-0535-4ede-b7e5-484812fd3711"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#00bd76a6-0535-4ede-b7e5-484812fd3711"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#04ced04a-97be-4b37-adb4-d0709c8e34a4"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#04ced04a-97be-4b37-adb4-d0709c8e34a4"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#04ced04a-97be-4b37-adb4-d0709c8e34a4"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#04ced04a-97be-4b37-adb4-d0709c8e34a4"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#06369953-ad32-46b4-9ebd-ce9c9ce9d992"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#06369953-ad32-46b4-9ebd-ce9c9ce9d992"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#06369953-ad32-46b4-9ebd-ce9c9ce9d992"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#06369953-ad32-46b4-9ebd-ce9c9ce9d992"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#0d70736a-da2c-4116-ae56-ccc277a7f833"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#0d70736a-da2c-4116-ae56-ccc277a7f833"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#0d70736a-da2c-4116-ae56-ccc277a7f833"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#0d70736a-da2c-4116-ae56-ccc277a7f833"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-50560",
"source": {
"name": "ghsa",
"url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
},
"ratings": [
{
"source": {
"name": "ghsa"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "nvd"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "redhat"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
}
],
"cwes": [
770
],
"description": "Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty HTTP/2 max header size handling produces an attack similar to HTTP/2 Rapid Reset. There is a setting in the http2 specification called `SETTINGS_MAX_HEADER_LIST_SIZE`. When a client sends that setting to Netty, it appears that Netty will behave as follows: read the request; proxy the request to the origin; attempt to produce a response; and create an exception while writing the headers for the response. Functionally, this should be similar to the http2 reset attack, but with a different on-the-wire signature. Versions 4.1.135.Final and 4.2.15.Final patch the issue.",
"recommendation": "Upgrade io.netty:netty-codec-http2 to version 4.2.15.Final, 4.1.135.Final",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-50560"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-50560"
},
{
"url": "https://github.com/netty/netty"
},
{
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"url": "https://github.com/netty/netty/security/advisories/GHSA-563q-j3cm-6jxm"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50560"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50560"
},
{
"url": "https://www.rfc-editor.org/rfc/rfc9113.html#name-defined-settings"
}
],
"published": "2026-06-12T16:16:32+00:00",
"updated": "2026-06-15T02:30:57+00:00",
"affects": [
{
"ref": "pkg:maven/io.netty/netty-codec-http2@4.1.133.Final",
"versions": [
{
"version": "4.1.133.Final",
"status": "affected"
}
]
},
{
"ref": "pkg:maven/io.netty/netty-codec-http2@4.1.133.Final",
"versions": [
{
"version": "4.1.133.Final",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#15595dd2-d08f-4b86-bf61-f0d2334b4f6a"
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#15595dd2-d08f-4b86-bf61-f0d2334b4f6a"
},
{
"ref": "urn:cdx:605c4cf6-768c-4740-88af-644c86949366/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:605c4cf6-768c-4740-88af-644c86949366/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:5edaa6b5-97a5-4cb5-86fd-5c8da204e917/1#0e0894ab-7b48-4c85-bdb2-f828ff324d91"
},
{
"ref": "urn:cdx:5edaa6b5-97a5-4cb5-86fd-5c8da204e917/1#0e0894ab-7b48-4c85-bdb2-f828ff324d91"
},
{
"ref": "urn:cdx:5c15d8a3-b4c2-4b3e-942e-57b2854d6d7c/1#8cd5125d-fa9e-40e3-bc5f-1910b5c45e77"
},
{
"ref": "urn:cdx:5c15d8a3-b4c2-4b3e-942e-57b2854d6d7c/1#8cd5125d-fa9e-40e3-bc5f-1910b5c45e77"
},
{
"ref": "urn:cdx:1984c021-252b-4038-b5c2-7dc58cdccb34/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:1984c021-252b-4038-b5c2-7dc58cdccb34/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:d9316630-0b4e-424a-9b57-0891facfdb48/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:d9316630-0b4e-424a-9b57-0891facfdb48/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:0bc95285-afe2-4a8c-b014-7ea60e19327f/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:0bc95285-afe2-4a8c-b014-7ea60e19327f/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:32a0fc77-dccf-43c8-8d4e-779797d168d8/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:32a0fc77-dccf-43c8-8d4e-779797d168d8/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:9248c11a-a6c2-4e62-9a2e-7f374f557cd6/1#14c29612-0540-4047-b097-80520294fffc"
},
{
"ref": "urn:cdx:9248c11a-a6c2-4e62-9a2e-7f374f557cd6/1#14c29612-0540-4047-b097-80520294fffc"
},
{
"ref": "urn:cdx:41ca6524-f05d-4db2-91ba-d967a3eecf30/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:41ca6524-f05d-4db2-91ba-d967a3eecf30/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#5c904e5a-415e-450c-8ddf-3ec131cd589a"
},
{
"ref": "urn:cdx:63a91151-9cdb-48df-b339-f99c08ae26ef/1#5c904e5a-415e-450c-8ddf-3ec131cd589a"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#52cd21f3-5953-437a-a4db-d140008d8902"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#52cd21f3-5953-437a-a4db-d140008d8902"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#1776a18b-ea19-493e-8448-534e37ab7d8f"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#1776a18b-ea19-493e-8448-534e37ab7d8f"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#69f56401-e0fc-4ef4-99e0-b18c658d9031"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#69f56401-e0fc-4ef4-99e0-b18c658d9031"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#1c6b1358-f010-497c-a98c-d6d5bc8792c2"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#1c6b1358-f010-497c-a98c-d6d5bc8792c2"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#3f5ff3a2-75c6-4c09-8c5b-511f3ba9e585"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#3f5ff3a2-75c6-4c09-8c5b-511f3ba9e585"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:maven/io.netty/netty-codec-http2@4.1.133.Final"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#0516a687-afe5-406f-a8e5-770219d501d7"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#0516a687-afe5-406f-a8e5-770219d501d7"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#89d14707-85fd-42b0-908d-baaca95ac2dc"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#89d14707-85fd-42b0-908d-baaca95ac2dc"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#377fb494-a49d-4195-9bcf-c5523a356391"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#377fb494-a49d-4195-9bcf-c5523a356391"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#1685dc87-848a-45b7-943b-1ab110607431"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#1685dc87-848a-45b7-943b-1ab110607431"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#3850e28d-2fe3-4fe9-bb10-41f7a6066903"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#3850e28d-2fe3-4fe9-bb10-41f7a6066903"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#777bc6f0-dee4-4de5-9f8c-3dedd8c1e4b9"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#777bc6f0-dee4-4de5-9f8c-3dedd8c1e4b9"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-44250",
"source": {
"name": "ghsa",
"url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
},
"ratings": [
{
"source": {
"name": "ghsa"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"cwes": [
400
],
"description": "Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending a crafted Redis payload with deeply nested arrays. This forces the server to allocate a massive number of state objects and collections, leading to memory exhaustion and an OutOfMemoryError. Versions 4.1.135.Final and 4.2.15.Final patch the issue.",
"recommendation": "Upgrade io.netty:netty-codec-redis to version 4.2.15.Final, 4.1.135.Final",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-44250"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-44250"
},
{
"url": "https://github.com/netty/netty"
},
{
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"url": "https://github.com/netty/netty/security/advisories/GHSA-3244-j874-rhc2"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44250"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44250"
}
],
"published": "2026-06-11T22:16:56+00:00",
"updated": "2026-06-15T02:30:38+00:00",
"affects": [
{
"ref": "pkg:maven/io.netty/netty-codec-redis@4.1.133.Final",
"versions": [
{
"version": "4.1.133.Final",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#7c1cf829-b25a-4f5d-ad2e-7b484f63f3c3"
},
{
"ref": "urn:cdx:5c15d8a3-b4c2-4b3e-942e-57b2854d6d7c/1#456e2875-10e7-405c-a742-bc090d75c661"
},
{
"ref": "urn:cdx:1984c021-252b-4038-b5c2-7dc58cdccb34/1#pkg:maven/io.netty/netty-codec-redis@4.1.133.Final"
},
{
"ref": "urn:cdx:0bc95285-afe2-4a8c-b014-7ea60e19327f/1#pkg:maven/io.netty/netty-codec-redis@4.1.133.Final"
},
{
"ref": "urn:cdx:9248c11a-a6c2-4e62-9a2e-7f374f557cd6/1#333b6393-6043-40df-937e-181892e451c8"
},
{
"ref": "urn:cdx:41ca6524-f05d-4db2-91ba-d967a3eecf30/1#pkg:maven/io.netty/netty-codec-redis@4.1.133.Final"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:maven/io.netty/netty-codec-redis@4.1.133.Final"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#10a60dc1-3059-4c84-9386-6d708924de29"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#05543c31-df2e-479e-a563-6f110b2db857"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:maven/io.netty/netty-codec-redis@4.1.133.Final"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#1646c198-ec45-46e2-884d-48c02cd1ad57"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#32e329d0-f184-47b3-96d8-fa7013e681b7"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#7016a2d8-3025-4e7b-b29a-aef3ace2143d"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#429e9556-a8be-4240-a7cc-f93bf7569790"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#30b4301c-9405-40f2-9b48-a91a7d75c2c0"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#3764cae2-88b9-47ce-a551-95a2dac9c801"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#7a0ae9e4-27d1-49f6-bed7-2f1aec3ef14a"
}
],
"analysis": {
"state": "in_triage",
"justification": "",
"response": [],
"detail": "This CVE is under investigation by Confluent."
}
},
{
"id": "CVE-2026-44890",
"source": {
"name": "ghsa",
"url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
},
"ratings": [
{
"source": {
"name": "ghsa"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"cwes": [
400
],
"description": "Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending crafted Redis payloads across multiple connections without `\\r\\n`. This exhausts the server's direct memory pool (OutOfDirectMemoryError), preventing legitimate connections from being processed. Versions 4.1.135.Final and 4.2.15.Final patch the issue.",
"recommendation": "Upgrade io.netty:netty-codec-redis to version 4.2.15.Final, 4.1.135.Final",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-44890"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-44890"
},
{
"url": "https://github.com/netty/netty"
},
{
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"url": "https://github.com/netty/netty/security/advisories/GHSA-6ghj-frrj-jjj3"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44890"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44890"
}
],
"published": "2026-06-11T22:16:56+00:00",
"updated": "2026-06-15T02:30:28+00:00",
"affects": [
{
"ref": "pkg:maven/io.netty/netty-codec-redis@4.1.133.Final",
"versions": [
{
"version": "4.1.133.Final",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#7c1cf829-b25a-4f5d-ad2e-7b484f63f3c3"
},
{
"ref": "urn:cdx:5c15d8a3-b4c2-4b3e-942e-57b2854d6d7c/1#456e2875-10e7-405c-a742-bc090d75c661"
},
{
"ref": "urn:cdx:1984c021-252b-4038-b5c2-7dc58cdccb34/1#pkg:maven/io.netty/netty-codec-redis@4.1.133.Final"
},
{
"ref": "urn:cdx:0bc95285-afe2-4a8c-b014-7ea60e19327f/1#pkg:maven/io.netty/netty-codec-redis@4.1.133.Final"
},
{
"ref": "urn:cdx:9248c11a-a6c2-4e62-9a2e-7f374f557cd6/1#333b6393-6043-40df-937e-181892e451c8"
},
{
"ref": "urn:cdx:41ca6524-f05d-4db2-91ba-d967a3eecf30/1#pkg:maven/io.netty/netty-codec-redis@4.1.133.Final"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:maven/io.netty/netty-codec-redis@4.1.133.Final"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#10a60dc1-3059-4c84-9386-6d708924de29"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#05543c31-df2e-479e-a563-6f110b2db857"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:maven/io.netty/netty-codec-redis@4.1.133.Final"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#1646c198-ec45-46e2-884d-48c02cd1ad57"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#32e329d0-f184-47b3-96d8-fa7013e681b7"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#7016a2d8-3025-4e7b-b29a-aef3ace2143d"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#429e9556-a8be-4240-a7cc-f93bf7569790"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#30b4301c-9405-40f2-9b48-a91a7d75c2c0"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#3764cae2-88b9-47ce-a551-95a2dac9c801"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#7a0ae9e4-27d1-49f6-bed7-2f1aec3ef14a"
}
],
"analysis": {
"state": "in_triage",
"justification": "",
"response": [],
"detail": "This CVE is under investigation by Confluent."
}
},
{
"id": "CVE-2026-44893",
"source": {
"name": "ghsa",
"url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
},
"ratings": [
{
"source": {
"name": "ghsa"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"cwes": [
703
],
"description": "Netty is a network application framework for development of protocol servers and clients. In netty-codec-haproxy prior to versions 4.1.135.Final and 4.2.15.Final, when decoding a PP2_TYPE_SSL TLV, HAProxyMessage.readNextTLV() first calls `header.retainedSlice(header.readerIndex(), length)` and only then reads the 1-byte client field and 4-byte verify field. If the attacker sets the TLV length below 5, the subsequent readByte/readInt throws IndexOutOfBoundsException. HAProxyMessageDecoder only catches HAProxyProtocolException around this call, so the IOOBE propagates and the retained slice on the pooled cumulation buffer is never released. Versions 4.1.135.Final and 4.2.15.Final patch the issue.",
"recommendation": "Upgrade io.netty:netty-codec-haproxy to version 4.2.15.Final, 4.1.135.Final",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-44893"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-44893"
},
{
"url": "https://github.com/netty/netty"
},
{
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"url": "https://github.com/netty/netty/security/advisories/GHSA-cc37-9q2j-3hfv"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44893"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44893"
}
],
"published": "2026-06-12T15:16:26+00:00",
"updated": "2026-06-15T02:23:31+00:00",
"affects": [
{
"ref": "pkg:maven/io.netty/netty-codec-haproxy@4.1.133.Final",
"versions": [
{
"version": "4.1.133.Final",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#54690f73-6ff9-49ea-bdf9-dc08823f00e8"
},
{
"ref": "urn:cdx:605c4cf6-768c-4740-88af-644c86949366/1#pkg:maven/io.netty/netty-codec-haproxy@4.1.133.Final"
},
{
"ref": "urn:cdx:5c15d8a3-b4c2-4b3e-942e-57b2854d6d7c/1#ba4f462e-6ae5-429d-a101-90bec34f10f2"
},
{
"ref": "urn:cdx:1984c021-252b-4038-b5c2-7dc58cdccb34/1#pkg:maven/io.netty/netty-codec-haproxy@4.1.133.Final"
},
{
"ref": "urn:cdx:d9316630-0b4e-424a-9b57-0891facfdb48/1#pkg:maven/io.netty/netty-codec-haproxy@4.1.133.Final"
},
{
"ref": "urn:cdx:0bc95285-afe2-4a8c-b014-7ea60e19327f/1#pkg:maven/io.netty/netty-codec-haproxy@4.1.133.Final"
},
{
"ref": "urn:cdx:9248c11a-a6c2-4e62-9a2e-7f374f557cd6/1#cd059025-ae95-4759-9f39-f9255a063aa6"
},
{
"ref": "urn:cdx:41ca6524-f05d-4db2-91ba-d967a3eecf30/1#pkg:maven/io.netty/netty-codec-haproxy@4.1.133.Final"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:maven/io.netty/netty-codec-haproxy@4.1.133.Final"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#04d2afaf-53e8-46de-a97c-a8a2fbe1156d"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#06ab8ff8-6467-49a8-9ed6-b89876524c3a"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:maven/io.netty/netty-codec-haproxy@4.1.133.Final"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#5d78987d-6ccd-4375-a381-dfcc2bd9d703"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:maven/io.netty/netty-codec-haproxy@4.1.133.Final"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#18c623da-b8fd-48ff-aa44-c36d8dadaa3a"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#5b1f0bac-bb9a-4c95-80e2-a010119a1a71"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#3c1ed474-c2d5-46b7-857a-78b7a7f27131"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#2f42c3f1-e6fa-4402-a257-7bd48af9e5ed"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#0f6001ae-2c27-4df7-b0f9-53b7dd53f7ae"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#133efaba-a3d6-4007-a58a-c498b06e4182"
}
],
"analysis": {
"state": "in_triage",
"justification": "",
"response": [],
"detail": "This CVE is under investigation by Confluent."
}
},
{
"id": "CVE-2026-46340",
"source": {
"name": "ghsa",
"url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
},
"ratings": [
{
"source": {
"name": "ghsa"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"cwes": [
770
],
"description": "Netty is a network application framework for development of protocol servers and clients. In versions of netty-transport-sctp prior to 4.1.135.Final and 4.2.15.Final, for each non-complete SctpMessage fragment the handler does `fragments.put(streamId, Unpooled.wrappedBuffer(frag, byteBuf))`, wrapping the previous accumulator and the new slice into a *new* CompositeByteBuf every time. After N fragments the accumulator is an N-deep chain of composites, each holding references and component arrays; readableBytes()/getBytes() on the final buffer recurse N levels. There is no limit on N, on total bytes, or on the number of streamIdentifiers an attacker can open (each gets its own map entry). A peer that never sets the `complete` flag can grow this structure indefinitely from tiny 1-byte DATA chunks. Versions 4.1.135.Final and 4.2.15.Final patch the issue.",
"recommendation": "Upgrade io.netty:netty-transport-sctp to version 4.2.15.Final, 4.1.135.Final",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-46340"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-46340"
},
{
"url": "https://github.com/netty/netty"
},
{
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"url": "https://github.com/netty/netty/security/advisories/GHSA-5xrh-qmmq-w6ch"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46340"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46340"
}
],
"published": "2026-06-12T15:16:27+00:00",
"updated": "2026-06-15T02:12:14+00:00",
"affects": [
{
"ref": "pkg:maven/io.netty/netty-transport-sctp@4.1.133.Final",
"versions": [
{
"version": "4.1.133.Final",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#64957dd2-a396-4ffc-8591-906052be2af1"
},
{
"ref": "urn:cdx:5c15d8a3-b4c2-4b3e-942e-57b2854d6d7c/1#bbb9a807-d993-4761-92d1-ed61546a12ae"
},
{
"ref": "urn:cdx:1984c021-252b-4038-b5c2-7dc58cdccb34/1#pkg:maven/io.netty/netty-transport-sctp@4.1.133.Final"
},
{
"ref": "urn:cdx:0bc95285-afe2-4a8c-b014-7ea60e19327f/1#pkg:maven/io.netty/netty-transport-sctp@4.1.133.Final"
},
{
"ref": "urn:cdx:9248c11a-a6c2-4e62-9a2e-7f374f557cd6/1#5265d9bb-d9f3-41ce-916b-66015d0d2537"
},
{
"ref": "urn:cdx:41ca6524-f05d-4db2-91ba-d967a3eecf30/1#pkg:maven/io.netty/netty-transport-sctp@4.1.133.Final"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:maven/io.netty/netty-transport-sctp@4.1.133.Final"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#0d50a7c2-12a9-42dc-897c-9aaa06d625f7"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#2effba36-97fb-42ea-8bf1-9504cecd8276"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:maven/io.netty/netty-transport-sctp@4.1.133.Final"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#983d4400-bb58-4ce5-b445-fcacca7ea5d0"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#57e44e37-e9dc-411e-9221-0360198737e3"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#0bcb12f2-f4c6-4b0e-a2c8-5c82af87f613"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#08ae6bcf-e389-44c0-b623-eee69beb679f"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#14599df9-ee3b-477f-8ad0-d51c1c6e234c"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#58e59984-ff3b-45a5-89d0-e6ac3bcfc8d7"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#b540524f-cc4c-4506-a847-aedd23702480"
}
],
"analysis": {
"state": "in_triage",
"justification": "",
"response": [],
"detail": "This CVE is under investigation by Confluent."
}
},
{
"id": "CVE-2026-48006",
"source": {
"name": "ghsa",
"url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
},
"ratings": [
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"cwes": [
401
],
"description": "Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the RedisArrayAggregator handler permanently leaks pooled direct-memory buffers when a Redis pipeline connection closes before a RESP array aggregate completes. The handler retains child messages in per-handler state (`depths` field) but defines no `channelInactive`, `handlerRemoved`, or `exceptionCaught` method to release them when the pipeline tears down. Because the leaked buffers are slices of `PooledByteBufAllocator` chunks, they prevent those chunks from being returned to the JVM-wide direct-memory pool. Repeated connection churn by any network peer monotonically drains this shared pool, eventually causing allocation failures on all Netty channels in the process. Versions 4.1.135.Final and 4.2.15.Final patch the issue.",
"recommendation": "Upgrade io.netty:netty-codec-redis to version 4.2.15.Final, 4.1.135.Final",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-48006"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-48006"
},
{
"url": "https://github.com/netty/netty"
},
{
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"url": "https://github.com/netty/netty/security/advisories/GHSA-6jv9-x5w9-2ccm"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48006"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-48006"
}
],
"published": "2026-06-12T16:16:30+00:00",
"updated": "2026-06-15T01:56:51+00:00",
"affects": [
{
"ref": "pkg:maven/io.netty/netty-codec-redis@4.1.133.Final",
"versions": [
{
"version": "4.1.133.Final",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#7c1cf829-b25a-4f5d-ad2e-7b484f63f3c3"
},
{
"ref": "urn:cdx:5c15d8a3-b4c2-4b3e-942e-57b2854d6d7c/1#456e2875-10e7-405c-a742-bc090d75c661"
},
{
"ref": "urn:cdx:1984c021-252b-4038-b5c2-7dc58cdccb34/1#pkg:maven/io.netty/netty-codec-redis@4.1.133.Final"
},
{
"ref": "urn:cdx:0bc95285-afe2-4a8c-b014-7ea60e19327f/1#pkg:maven/io.netty/netty-codec-redis@4.1.133.Final"
},
{
"ref": "urn:cdx:9248c11a-a6c2-4e62-9a2e-7f374f557cd6/1#333b6393-6043-40df-937e-181892e451c8"
},
{
"ref": "urn:cdx:41ca6524-f05d-4db2-91ba-d967a3eecf30/1#pkg:maven/io.netty/netty-codec-redis@4.1.133.Final"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:maven/io.netty/netty-codec-redis@4.1.133.Final"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#10a60dc1-3059-4c84-9386-6d708924de29"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#05543c31-df2e-479e-a563-6f110b2db857"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:maven/io.netty/netty-codec-redis@4.1.133.Final"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#1646c198-ec45-46e2-884d-48c02cd1ad57"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#32e329d0-f184-47b3-96d8-fa7013e681b7"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#7016a2d8-3025-4e7b-b29a-aef3ace2143d"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#429e9556-a8be-4240-a7cc-f93bf7569790"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#30b4301c-9405-40f2-9b48-a91a7d75c2c0"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#3764cae2-88b9-47ce-a551-95a2dac9c801"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#7a0ae9e4-27d1-49f6-bed7-2f1aec3ef14a"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-48059",
"source": {
"name": "ghsa",
"url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
},
"ratings": [
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"cwes": [
401
],
"description": "Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the HAProxy PROXY protocol v2 codec in netty leaks native or heap memory on every connection when a client sends a syntactically valid header containing nested `PP2_TYPE_SSL` TLVs (type-length-value records) at depth two or greater. The leak occurs on the successful parse path \u2014 no exception is thrown, the message fires downstream, the decoder removes itself, and the application releases the `HAProxyMessage` normally. Yet the underlying cumulation buffer (a pooled, potentially direct `ByteBuf` allocated by the channel) remains permanently pinned. Versions 4.1.135.Final and 4.2.15.Final patch the issue.",
"recommendation": "Upgrade io.netty:netty-codec-haproxy to version 4.2.15.Final, 4.1.135.Final",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-48059"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-48059"
},
{
"url": "https://github.com/netty/netty"
},
{
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"url": "https://github.com/netty/netty/security/advisories/GHSA-h2qv-fj59-j46j"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48059"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-48059"
}
],
"published": "2026-06-12T16:16:30+00:00",
"updated": "2026-06-15T01:56:30+00:00",
"affects": [
{
"ref": "pkg:maven/io.netty/netty-codec-haproxy@4.1.133.Final",
"versions": [
{
"version": "4.1.133.Final",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#54690f73-6ff9-49ea-bdf9-dc08823f00e8"
},
{
"ref": "urn:cdx:605c4cf6-768c-4740-88af-644c86949366/1#pkg:maven/io.netty/netty-codec-haproxy@4.1.133.Final"
},
{
"ref": "urn:cdx:5c15d8a3-b4c2-4b3e-942e-57b2854d6d7c/1#ba4f462e-6ae5-429d-a101-90bec34f10f2"
},
{
"ref": "urn:cdx:1984c021-252b-4038-b5c2-7dc58cdccb34/1#pkg:maven/io.netty/netty-codec-haproxy@4.1.133.Final"
},
{
"ref": "urn:cdx:d9316630-0b4e-424a-9b57-0891facfdb48/1#pkg:maven/io.netty/netty-codec-haproxy@4.1.133.Final"
},
{
"ref": "urn:cdx:0bc95285-afe2-4a8c-b014-7ea60e19327f/1#pkg:maven/io.netty/netty-codec-haproxy@4.1.133.Final"
},
{
"ref": "urn:cdx:9248c11a-a6c2-4e62-9a2e-7f374f557cd6/1#cd059025-ae95-4759-9f39-f9255a063aa6"
},
{
"ref": "urn:cdx:41ca6524-f05d-4db2-91ba-d967a3eecf30/1#pkg:maven/io.netty/netty-codec-haproxy@4.1.133.Final"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:maven/io.netty/netty-codec-haproxy@4.1.133.Final"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#04d2afaf-53e8-46de-a97c-a8a2fbe1156d"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#06ab8ff8-6467-49a8-9ed6-b89876524c3a"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:maven/io.netty/netty-codec-haproxy@4.1.133.Final"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#5d78987d-6ccd-4375-a381-dfcc2bd9d703"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:maven/io.netty/netty-codec-haproxy@4.1.133.Final"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#18c623da-b8fd-48ff-aa44-c36d8dadaa3a"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#5b1f0bac-bb9a-4c95-80e2-a010119a1a71"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#3c1ed474-c2d5-46b7-857a-78b7a7f27131"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#2f42c3f1-e6fa-4402-a257-7bd48af9e5ed"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#0f6001ae-2c27-4df7-b0f9-53b7dd53f7ae"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#133efaba-a3d6-4007-a58a-c498b06e4182"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-50011",
"source": {
"name": "ghsa",
"url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
},
"ratings": [
{
"source": {
"name": "ghsa"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"cwes": [
400,
770
],
"description": "Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, RedisArrayAggregator pre-allocates ArrayList with initial capacity equal to the RESP array element count declared in an array header. That count is taken from the wire before the corresponding child messages exist. A small malicious header can claim a huge initial capacity. Versions 4.1.135.Final and 4.2.15.Final patch the issue.",
"recommendation": "Upgrade io.netty:netty-codec-redis to version 4.2.15.Final, 4.1.135.Final",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-50011"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-50011"
},
{
"url": "https://github.com/netty/netty"
},
{
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
},
{
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
},
{
"url": "https://github.com/netty/netty/security/advisories/GHSA-5w86-c3rq-vjj7"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50011"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50011"
}
],
"published": "2026-06-12T16:16:31+00:00",
"updated": "2026-06-15T02:31:20+00:00",
"affects": [
{
"ref": "pkg:maven/io.netty/netty-codec-redis@4.1.133.Final",
"versions": [
{
"version": "4.1.133.Final",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#7c1cf829-b25a-4f5d-ad2e-7b484f63f3c3"
},
{
"ref": "urn:cdx:5c15d8a3-b4c2-4b3e-942e-57b2854d6d7c/1#456e2875-10e7-405c-a742-bc090d75c661"
},
{
"ref": "urn:cdx:1984c021-252b-4038-b5c2-7dc58cdccb34/1#pkg:maven/io.netty/netty-codec-redis@4.1.133.Final"
},
{
"ref": "urn:cdx:0bc95285-afe2-4a8c-b014-7ea60e19327f/1#pkg:maven/io.netty/netty-codec-redis@4.1.133.Final"
},
{
"ref": "urn:cdx:9248c11a-a6c2-4e62-9a2e-7f374f557cd6/1#333b6393-6043-40df-937e-181892e451c8"
},
{
"ref": "urn:cdx:41ca6524-f05d-4db2-91ba-d967a3eecf30/1#pkg:maven/io.netty/netty-codec-redis@4.1.133.Final"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:maven/io.netty/netty-codec-redis@4.1.133.Final"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#10a60dc1-3059-4c84-9386-6d708924de29"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#05543c31-df2e-479e-a563-6f110b2db857"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:maven/io.netty/netty-codec-redis@4.1.133.Final"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#1646c198-ec45-46e2-884d-48c02cd1ad57"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#32e329d0-f184-47b3-96d8-fa7013e681b7"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#7016a2d8-3025-4e7b-b29a-aef3ace2143d"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#429e9556-a8be-4240-a7cc-f93bf7569790"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#30b4301c-9405-40f2-9b48-a91a7d75c2c0"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#3764cae2-88b9-47ce-a551-95a2dac9c801"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#7a0ae9e4-27d1-49f6-bed7-2f1aec3ef14a"
}
],
"analysis": {
"state": "in_triage",
"justification": "",
"response": [],
"detail": "This CVE is under investigation by Confluent."
}
},
{
"id": "CVE-2026-8149",
"source": {
"name": "ghsa",
"url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
},
"ratings": [],
"cwes": [
1068
],
"description": "A vulnerability in Legion of the Bouncy Castle Inc. BC-LTS on Linux, X86_64, AVX, AVX-512f.\n\n This vulnerability is associated with program files gcm128w, gcm512w.\n\n\n\nThis issue affects BC-LTS: from 2.73.0 before 2.73.11.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-8149"
},
{
"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%908149"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8149"
}
],
"published": "2026-05-08T07:16:29+00:00",
"updated": "2026-05-19T00:16:37+00:00",
"affects": [
{
"ref": "pkg:maven/org.bouncycastle/bc-fips@2.1.2",
"versions": [
{
"version": "2.1.2",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#pkg:maven/org.bouncycastle/bc-fips@2.1.2"
},
{
"ref": "urn:cdx:605c4cf6-768c-4740-88af-644c86949366/1#pkg:maven/org.bouncycastle/bc-fips@2.1.2"
},
{
"ref": "urn:cdx:1984c021-252b-4038-b5c2-7dc58cdccb34/1#pkg:maven/org.bouncycastle/bc-fips@2.1.2"
},
{
"ref": "urn:cdx:d9316630-0b4e-424a-9b57-0891facfdb48/1#pkg:maven/org.bouncycastle/bc-fips@2.1.2"
},
{
"ref": "urn:cdx:b5e3ea0e-3953-4d71-9f97-b04d97cc22f4/1#pkg:maven/org.bouncycastle/bc-fips@2.1.2"
},
{
"ref": "urn:cdx:0bc95285-afe2-4a8c-b014-7ea60e19327f/1#pkg:maven/org.bouncycastle/bc-fips@2.1.2"
},
{
"ref": "urn:cdx:9248c11a-a6c2-4e62-9a2e-7f374f557cd6/1#3f24fe49-2d24-4059-ac65-43ace8134af8"
},
{
"ref": "urn:cdx:41ca6524-f05d-4db2-91ba-d967a3eecf30/1#pkg:maven/org.bouncycastle/bc-fips@2.1.2"
},
{
"ref": "urn:cdx:8e2dfcf4-4acc-47f4-a01a-b10f6797df9a/1#pkg:maven/org.bouncycastle/bc-fips@2.1.2"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#3efb0666-62c9-4061-a63d-89e409db1b31"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#05da8126-2f2b-4772-af9d-c0bb51454468"
},
{
"ref": "urn:cdx:619bc354-0ecc-491a-a5ed-60120f2b96f3/1#pkg:maven/org.bouncycastle/bc-fips@2.1.2"
},
{
"ref": "urn:cdx:e3ad3ccb-3d28-4fe8-a5fb-e61d6bf0f63a/1#2a517bf7-cdbe-4d13-8e14-7a71920fe838"
},
{
"ref": "urn:cdx:980eb2e8-da20-4633-95f8-cdf03b2ae177/1#pkg:maven/org.bouncycastle/bc-fips@2.1.2"
},
{
"ref": "urn:cdx:4f7147dd-d5f1-44b2-a746-7805704c8e0e/1#2cc722ca-cde7-45a2-81a7-5dca74d1de0e"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#032e4b5d-6b74-4619-af25-7dc7c04bf4b4"
},
{
"ref": "urn:cdx:81ecbd2c-c58e-4c47-bbde-1fdb97c8dc31/1#58e71899-778f-41fc-b5f9-bd01302fd86c"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#38c24fec-ba0d-4916-bb79-401058cb98df"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#38ac501a-e2ed-4f49-b32f-256f6d69ad93"
},
{
"ref": "urn:cdx:f32366ad-fa73-4ed9-adc6-06d6cb19a5be/1#481a4d9c-4d5f-478d-a9b7-b2786ea89df6"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-33117",
"source": {
"name": "ghsa",
"url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
},
"ratings": [
{
"source": {
"name": "ghsa"
},
"score": 9.1,
"severity": "critical",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
}
],
"cwes": [
287,
347
],
"description": "Improper authentication in Azure SDK allows an unauthorized attacker to bypass a security feature over a network.",
"recommendation": "Upgrade com.azure:azure-security-keyvault-keys to version 4.10.6",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-33117"
},
{
"url": "https://github.com/Azure/azure-sdk-for-java"
},
{
"url": "https://github.com/Azure/azure-sdk-for-java/commit/1b5c5c79d85a5c9a9cfd07f6cdff6fd0f50eccf9"
},
{
"url": "https://github.com/Azure/azure-sdk-for-java/pull/48476"
},
{
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33117"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33117"
}
],
"published": "2026-05-12T18:17:04+00:00",
"updated": "2026-05-15T18:38:17+00:00",
"affects": [
{
"ref": "pkg:maven/com.azure/azure-security-keyvault-keys@4.9.2",
"versions": [
{
"version": "4.9.2",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:40f400a6-f2d1-4af4-9fdc-4b43da977e77/1#pkg:maven/com.azure/azure-security-keyvault-keys@4.9.2"
},
{
"ref": "urn:cdx:605c4cf6-768c-4740-88af-644c86949366/1#pkg:maven/com.azure/azure-security-keyvault-keys@4.9.2"
},
{
"ref": "urn:cdx:32a0fc77-dccf-43c8-8d4e-779797d168d8/1#pkg:maven/com.azure/azure-security-keyvault-keys@4.9.2"
},
{
"ref": "urn:cdx:9ced9b92-ba0f-45cf-953d-fe3931690872/1#pkg:maven/com.azure/azure-security-keyvault-keys@4.9.2"
},
{
"ref": "urn:cdx:cef6a17a-ce73-4906-b645-e28f525d735f/1#pkg:maven/com.azure/azure-security-keyvault-keys@4.9.2"
},
{
"ref": "urn:cdx:4b2176a8-e07f-4079-8285-ab40c60da454/1#pkg:maven/com.azure/azure-security-keyvault-keys@4.9.2"
},
{
"ref": "urn:cdx:e2be065e-3e26-4b28-b8b9-83c3160dc4b0/1#pkg:maven/com.azure/azure-security-keyvault-keys@4.9.2"
},
{
"ref": "urn:cdx:aa90bbf9-5e58-4c45-ac8b-77ff50299eff/1#pkg:maven/com.azure/azure-security-keyvault-keys@4.9.2"
},
{
"ref": "urn:cdx:8dd06dde-92b4-4ff7-94d9-406a5fca4504/1#pkg:maven/com.azure/azure-security-keyvault-keys@4.9.2"
},
{
"ref": "urn:cdx:d0223ea6-02b6-4359-8fe5-79974da2a984/1#pkg:maven/com.azure/azure-security-keyvault-keys@4.9.2"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": null
}
}
],
"component": []
}